Shopify App Security: What the Selleasy Incident Means for Merchants

As of 3 November 2026.

You can take good care of your Shopify account and still be exposed through a connected app. Every installation creates another relationship of trust: a separate company receives certain permissions or shapes part of the shopping experience. How that company protects its own systems sits outside your admin.

The October 2026 attack on the Selleasy upsell app makes that dependency tangible. For merchants, it raises a practical operating question: Do you know which providers can affect the path to purchase, and how to take a problematic integration out of service in a controlled way?

Key takeaways

• Securing your merchant account does not replace a review of the providers connected to it.
• Review both an app’s data access and its influence on the storefront and purchasing flow. These are separate questions.
• Record the purpose, owner, support contact and exit procedure for important integrations.
• If an unexpected payment page appears, do not enter details. Document the flow and investigate through known contact channels. If manipulation is confirmed, protect further customers from exposure.

What is known about the Selleasy incident

According to Logbase, an attack on a legacy internal support tool on 13 October 2026 caused external checkout redirects. Merchant accounts and credentials were not used, it says. Its 28 October report describes the incident as resolved, without an affected-store count.

This establishes neither a breach of Shopify’s platform nor an independently verified account of losses.

Three questions behind every app installation

A lock on your own office tells you little about how a service provider works. Apps present a similar distinction: a strong password and two-factor authentication protect your access. They do not tell you who can make changes within the provider’s systems.

Three separate questions help you assess an app.

What data can it process? During installation, Shopify shows the requested access to personal and store data. Expand and read the details. A feature name such as “upselling” does not explain why every requested permission is necessary. Source: Shopify on installing apps.

Where does it affect the shopping experience? An admin report, a cart widget and a checkout function do different jobs. The technical implementation determines what an integration can actually change. Permission to access data does not automatically let an app run arbitrary checkout code. Equally, an unobtrusive appearance does not prove that an integration has little influence.

What other systems sit behind it? To you, an app might simply mean “product recommendations”. At the provider, that can involve a backend, a release process and support access. You do not need to be able to audit that entire chain yourself. You should, however, be able to get understandable answers about who checks it and how you would hear about an incident.

This distinction also improves app selection. The right Shopify app needs to justify its benefits and remain manageable as part of your operation.

A useful inventory can fit on one page

Start with apps that touch money, orders, customer data or visible parts of the purchasing flow. Then work through the rest. The table below is a template for your own assessment, not a description of any particular app’s permissions.

These examples describe a hypothetical store. For a shipping or inventory integration, the exit procedure could be considerably more involved. That is precisely why the question belongs ahead of the next disruption.

In Shopify, go to Settings → Apps → the relevant app for permissions, activity and extensions. For third-party apps, Shopify also shows access activity over the past 30 days and unused permissions. Shopify’s own apps are currently excluded from this activity tracking. Source: Shopify on managing apps.

Use that information to ask better questions. An unused permission is worth raising with the provider; a high request count alone does not prove abuse. An app that synchronises frequently can generate many legitimate requests. And a quiet dashboard is no substitute for investigating its other systems.

Turn the review into a small routine

A new app, a request for changed permissions or a substantial store redesign is a good reason to review the setup again. Add a recurring appointment: perhaps a monthly walkthrough of the purchasing flow and a quarterly review of the complete app inventory. These are organisational recommendations; a store that changes frequently may need a tighter schedule.

Walk through your own store as a customer: product, cart, checkout and the intended payment methods. Include at least a mobile view and a fresh browser session. If consent choices or signing in change the flow, document those variants too. For an end-to-end transaction, use an appropriate test environment or a deliberately planned test purchase.

Record the date, the variant you checked and the expected transitions. That gives you a basis for assessing later changes without relying on memory. A new domain is initially a deviation to explain: it may belong to a payment service you configured. A familiar logo or an encrypted connection alone does not settle the question.

This walkthrough is a functional check with security benefits. It does not prove that every visitor sees the same flow or that every provider’s systems are secure. Its value lies in discovering unusual changes sooner, with enough detail to investigate them.

How to respond to a suspicious redirect

A customer report such as “I was sent to another site when I tried to pay” deserves prompt attention. The sequence should combine customer protection with useful evidence.

1. Do not continue through the suspicious flow. Enter neither payment details nor Shopify credentials on the unfamiliar page. Ask the customer who reported it to stop there too. You do not need their card number or password to investigate.

2. Preserve the specific observation. Record the time and time zone, starting page, destination address, device and immediately preceding steps. A screenshot may help. Share information through a secure support channel and remove unnecessary customer data; complete URLs can also contain confidential parameters. Have the responsible technical person preserve logs before routine cleanup overwrites them.

3. Check through established channels. Open your Shopify admin and use the agency, app provider and, where relevant, payment provider contacts you already have on record. Do not use a phone number or sign-in page supplied by the suspicious screen. Establish together whether the redirect belongs to your configured payment flow and whether there are current incident notices.

4. Interrupt a confirmed dangerous purchasing flow. If the responsible integration can be safely identified and disabled, do that first. If it cannot, and customers are still being sent to a manipulated payment page, temporarily stop the affected sales flow. The specific measure depends on the store; involve Shopify Support and your technical team. Pausing advertising alone does not prevent people from visiting directly.

5. Assess recovery and consequences separately. Record what was changed, then check the affected flow again. You also need to establish the time window, potentially affected orders and whether data was exposed. Communicate with customers on the basis of verified findings. Anyone who entered payment details on an unauthorised page should contact their payment service or bank through its established channels. If an actual data incident occurred, obtain appropriate specialist advice on reporting and notification duties.

Why deleting an app is not a recovery plan

Shopify warns that uninstalling an app can interrupt its features and dependent workflows. Some apps leave theme code behind; preserve data you need and check additional removal steps with the provider first. Source: Shopify on uninstalling apps.

For your own plan, describe both the immediate interruption of a problematic feature and complete removal. Hiding an element does not establish that all associated access has ended. Equally, an unprepared uninstall should not accidentally prevent you from fulfilling orders customers have already paid for.

During an active attack, perfect documentation must not delay customer protection. This is where a predefined exit procedure earns its place: you can act while knowing which follow-up work remains.

What answers you can expect from a provider

On 20 October, Shopify called on app developers to secure accounts, remove outdated access and review their systems, among other measures. Responsibility also sits with the provider. Source: Shopify, “Securing your app together”.

Ask specific questions: Does your security review cover internal support tools? How do you limit staff access to stores? How would an urgent security notice reach us? How can we remove your integration completely? An understandable answer is more useful than a general promise that security is the company’s highest priority.

Shopify also introduced a security check for app developers on 15 October, recommending it before submission and on every release. Shopify itself emphasises that a clean report is no guarantee of security. Source: AI Toolkit security check announcement. For a merchant, that provides another question to ask about the provider’s review process. A new scanner does not replace an assessment of that process.

You can start with one concrete action: open the app list, choose the integration with the greatest influence on the purchasing flow and document how to disable or remove it. If you cannot establish who owns it or what would happen when it is switched off, you have already found a specific gap you can close.

Sources and scope

Checked on 3 November 2026. The account of the attack comes from the affected provider. The operational recommendations are our editorial assessment for merchants.

• Logbase: Security incident update, updated 28 October 2026
• Shopify Help Center: Installing apps
• Shopify Help Center: Managing apps
• Shopify Help Center: Uninstalling apps
• Shopify Developer Community: Securing your app together, 20 October 2026
• Shopify Developer Blog: AI Toolkit security check, 15 October 2026