Skip to content

Shopify data sharing & exposure security checks

External sharing, public links, guest access, retention and data-protection settings that quietly push company data outside the tenant.

On Shopify, Black Cat runs 6 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Shopify connector needs.

Checks (6)

severity: medium Password Protection Disabled fix difficulty: easy #

Enable storefront password protection to prevent public access to the store during setup

  1. Log in to the Shopify admin as the store owner or staff with Online Store permissions
  2. Navigate to Online Store > Preferences
  3. Scroll to the "Password protection" section
  4. Check "Restrict access to visitors with the password" and set a password
  5. Click Save to apply the password protection
  6. Share the password only with authorized stakeholders

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: high Webhook Using HTTP fix difficulty: easy #

Update webhook destination URLs to use HTTPS to protect data in transit

  1. Log in to the Shopify admin as the store owner or staff with notification permissions
  2. Navigate to Settings > Notifications
  3. Scroll to the "Webhooks" section at the bottom of the page
  4. Identify the webhook with an HTTP destination URL
  5. Click the webhook to edit it, or delete it and recreate it with an HTTPS URL
  6. Enter the corrected HTTPS endpoint URL and save the changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii GDPR (SaaS Security) GDPR-44.2 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: low Webhook External Destination fix difficulty: easy #

Verify and document all external webhook destinations are authorized and expected

  1. Log in to the Shopify admin as the store owner or staff with notification permissions
  2. Navigate to Settings > Notifications
  3. Scroll to the "Webhooks" section at the bottom of the page
  4. Review each webhook's destination URL and confirm it belongs to an approved external service
  5. Delete any webhooks pointing to unrecognized or unauthorized external destinations
  6. Document approved external webhook destinations in your organization's asset inventory

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: high Unauthenticated Read Customers Scope fix difficulty: medium #

Remove unauthenticated customer read scopes to prevent PII exposure without authentication

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the unauthenticated_read_customers scope
  6. Save the changes and confirm the Storefront API integration still meets the app's requirements

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: high Write Customers Read Payment Scope fix difficulty: medium #

Remove the combination of write_customers and payment read scopes to eliminate data-harvesting risk

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Remove either write_customers or all read_payment* scopes depending on the app's legitimate use case
  6. Save the changes and review recent customer record and payment data access in the store audit log

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: medium Webhook Customer Data Topic fix difficulty: easy #

Verify that webhooks subscribed to customer data events send PII to secure, authorized destinations

  1. Log in to the Shopify admin as the store owner or staff with notification permissions
  2. Navigate to Settings > Notifications
  3. Scroll to the Webhooks section at the bottom of the page
  4. Identify webhooks subscribed to customer topics (customers/create, customers/update, etc.)
  5. Verify each destination URL belongs to an authorized, secure endpoint
  6. Remove webhooks that are no longer needed or point to unknown destinations

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

More Shopify checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial