There’s been a lot of speculation about @aftersell over the last week, including some erroneous claims about checkout hijacking. We understand given what's going on in the ecosystem but here's what actually happened to Aftersell 👇 Starting October 7th, an attacker sent millions of malicious requests to our servers. Most failed or did nothing, but the attack exposed non-sensitive upsell configuration data (e.g. discount settings) from a subset of 22 stores and they have of course been notified. It was an automated and almost certainly AI-assisted attack. It sent millions of requests in a single day, and switched to a pool of 1,460 rotating IP addresses. The moment we blocked one, the next one would appear. We closed the vulnerability within two hours. For everyone speculating about checkout hijacking, I want to make it very clear that this DID NOT happen to us. No shopper data or payment info was exposed, and no money moved. Aftersell merchants do not need to take any action - the app remains fully functional. No sensitive data was exposed, but the responsible thing was to take ownership and make sure the security of our product came first. I’d rather take the install hit before BFCM than ask merchants to trust us before we’d checked everything. Here’s what we’ve done since: → We’ve been working closely with Shopify’s security team and have brought in third parties for external incident review, VAPT, and specialized pen testing. → Aftersell is part of Rokt, and Rokt’s security team has run this investigation. The team is led by an ex-FBI cybersecurity leader and recently joined Anthropic’s Cyber Verification Program, which gives our security team access to Anthropic’s most capable models for defensive work. These models are now continuously reviewing every public route on Aftersell and are built into our security stack. → We have informed the FBI and other partners that share cyber threat intelligence to help stop attackers in the ecosystem. We will continue to work with the cybersecurity community to ensure the highest of security standards on Aftersell. → We are working with Shopify to ensure we get re-listed as soon as possible so new stores can install and set up Aftersell ahead of BFCM. Our commitment to the merchants who use or are considering Aftersell: 1) Security comes first on our roadmap. Our entire engineering team has spent the last few weeks on security work, and we’re using AI to defend against AI, with those same models now built into our security stack. We’ll keep investing, and we’ll stay transparent. If something affects your store, you’ll hear it from us. This is an always on program. We contacted affected merchants, we will always do this to ensure you know what is going on. 2) We’ll share what we learn. Attacks like this are becoming more common by the day across all platforms and we want to help our partners get ahead of them too. More on this soon. If your Shopify app has been hit by something similar, DM me. Happy to share our notes and learnings. We take a lot of pride in serving a large portion of the Shopify ecosystem, and we’re committed to building the best and most secure upsell product out there. If you have questions, comment below or DM me directly.

There’s been a lot of speculation about @aftersell over the last week, including some erroneous claims about checkout hijacking. We understand given what's going on in the ecosystem but here's what actually happened to Aftersell 👇 Starting October 7th, an attacker sent millions of malicious requests to our servers. Most failed or did nothing, but the attack exposed non-sensitive upsell configuration data (e.g. discount settings) from a subset of 22 stores and they have of course been notified. It was an automated and almost certainly AI-assisted attack. It sent millions of requests in a single day, and switched to a pool of 1,460 rotating IP addresses. The moment we blocked one, the next one would appear. We closed the vulnerability within two hours. For everyone speculating about checkout hijacking, I want to make it very clear that this DID NOT happen to us. No shopper data or payment info was exposed, and no money moved. Aftersell merchants do not need to take any action - the app remains fully functional. No sensitive data was exposed, but the responsible thing was to take ownership and make sure the security of our product came first. I’d rather take the install hit before BFCM than ask merchants to trust us before we’d checked everything. Here’s what we’ve done since: → We’ve been working closely with Shopify’s security team and have brought in third parties for external incident review, VAPT, and specialized pen testing. → Aftersell is part of Rokt, and Rokt’s security team has run this investigation. The team is led by an ex-FBI cybersecurity leader and recently joined Anthropic’s Cyber Verification Program, which gives our security team access to Anthropic’s most capable models for defensive work. These models are now continuously reviewing every public route on Aftersell and are built into our security stack. → We have informed the FBI and other partners that share cyber threat intelligence to help stop attackers in the ecosystem. We will continue to work with the cybersecurity community to ensure the highest of security standards on Aftersell. → We are working with Shopify to ensure we get re-listed as soon as possible so new stores can install and set up Aftersell ahead of BFCM. Our commitment to the merchants who use or are considering Aftersell: 1) Security comes first on our roadmap. Our entire engineering team has spent the last few weeks on security work, and we’re using AI to defend against AI, with those same models now built into our security stack. We’ll keep investing, and we’ll stay transparent. If something affects your store, you’ll hear it from us. This is an always on program. We contacted affected merchants, we will always do this to ensure you know what is going on. 2) We’ll share what we learn. Attacks like this are becoming more common by the day across all platforms and we want to help our partners get ahead of them too. More on this soon. If your Shopify app has been hit by something similar, DM me. Happy to share our notes and learnings. We take a lot of pride in serving a large portion of the Shopify ecosystem, and we’re committed to building the best and most secure upsell product out there. If you have questions, comment below or DM me directly.

Meet the Aftersell Cart. Have an idea. Prompt AI. Build a new variation in seconds. → Test an entirely different cart layout → Redesign how your upsells look and where they appear → Build custom sections that feel like your brand A/B test, see what shoppers respond to, then build the next version. That’s the part I’m excited about. This turns “we should try this” into a new variation in seconds so you can test and improve faster. We’re breaking this down in a live masterclass with Grüns on Oct 22. Sign up and get 3 cart templates: rokt.wistia.com/live/events/…

✅ 900+ reviews on the Shopify App Store Huge thanks to everyone who wrote us one. 96 to go. Road to 1,000 is on!

We’re 2 reviews away from 900 Our CS team has been GRINDING nonstop to get us there. If you use @Aftersell… A quick review on the Shopify App Store would mean a lot 🙏

We spent $131,239 getting our 60 person team in one place for 3 days. By the next Monday, we’d already ROI’d it. Our team is split across Toronto, Vancouver, Calgary and NYC... So we packed in a lot: → Reviewed the last 6 months → Set our Big 3 goals for H2 → Revealed a new product → Ran client fireside chats → Hosted a Twitter-Maxxing workshop → Watched @VarunKundra go head-to-head with @BEBuchanan in a mock sales pitch The week after, there was less back and forth. People knew what mattered and what they owned. The team is locked in. We’re on pace for our best week ever. Bring your team together. You won’t regret it!

I’m transferring this exact funnel (from our demo store) into the first 20 brands that comment. why it converts: you catch people right after they paid and hand them money back to switch to a sub. one-time buyer in, subscriber out.

Every year we spend a TON of $$$s getting the @Aftersell team together for an offsite 70 cracked people in one location Three of my biggest takeaways: 1. Building is more fun in person, with people you like and respect No shade to working remote but man the energy slaps 2. Win one week at a time How we show up next week determines our trajectory for the next six 3. Agency + ownership > everything else I'm looking for the person who cares more than everybody else Offisites... smart? Or just an excuse to party? 😅 LMK