security-hardening_skill

Overview

This skill documents practical security hardening for Shopify apps built with Remix. It consolidates authentication, webhook verification, input validation, data protection, rate limiting, secure headers, and secure coding patterns aligned with OWASP Top 10. Use it to make apps safer, comply with platform reviews, and reduce legal risk around merchant and customer data.

How this skill works

The guidance inspects common attack surfaces and shows concrete patterns to defend them: mandatory route and API authentication, HMAC-verified webhooks, strict input validation and sanitization, parameterized queries, safe command execution, and CSP and other security headers. It also covers secret management, encryption for sensitive fields, data retention and deletion workflows, rate limiting, and secure logging practices.

When to use it

• When building or auditing a Remix-based Shopify app handling merchant or customer data
• Before submitting an app for Shopify review to meet security expectations
• When implementing webhooks, API routes, or admin-facing pages
• When storing or transmitting sensitive data like tokens, emails, or payment metadata
• When adding third-party binaries, raw SQL, or any user-supplied content

Best practices

• Authenticate every request (pages, API routes, webhooks) and avoid exposing session tokens to the client
• Verify webhook HMACs using the raw request body before processing
• Validate and sanitize all user input with schemas and DOMPurify for any HTML
• Use parameterized queries or ORM helpers; avoid string-interpolated SQL
• Encrypt sensitive values at rest with a vetted algorithm and a secure key from env
• Set strict security headers and a Content Security Policy tailored to Shopify

Example use cases

• Protecting admin API endpoints that manage products and orders
• Verifying and processing Shopify webhooks (app uninstall, GDPR requests)
• Storing encrypted metafields for sensitive customer identifiers
• Implementing rate limiting on export endpoints to prevent abuse
• Applying CSP and frame-ancestors so embedded apps only load in Shopify