CEO at Stellar | Helping Brands Grow Revenue Through AI & Web Development
- Tweets 18
- Following 90
- Followers 4
- Likes 4
@Shopify has introduced a new tool to check app security. But finding vulnerabilities isn’t the same as preventing them from reaching production.
shopify app security check is a new command in Shopify CLI and the AI Toolkit. You run it on your own machine, and it looks for the most common security holes:
– a password or API key left in the code
– one store being able to see another store’s data
– endpoints that accept requests without checking who sent them 🧵
Merchant trust is everything
Which means security is everything
Introducing `app security check`
A tool that finds common vulnerability patterns in Shopify apps
Run it with AI Toolkit
1
9
It works in two steps:
1Fixed rules catch the obvious things first, like an outdated API version.
2Your AI coding agent (Claude Code, Cursor, Codex) reviews what rules can’t judge, like whether each store really sees only its own data.
You get one report: file and line, severity, and how to fix it. 36 checks in total, 25 of them high severity.
The catch: by default, it only reports problems. It won’t block a release, even if it finds something critical.
1
2
What I’d do:
– Run it on every app you maintain. Partners who tested it found gaps they didn’t know about, in authentication and in how store data was kept separate.
– Add --blocking high to your release pipeline, so serious findings actually stop the release.
– Use --include-dir if your backend lives in a separate repo.
– Run it through an AI agent, or you only get the rule-based part.
– Treat a clean report as the minimum, not a guarantee.
A security check that doesn’t block releases by default is only half the job.
Docs: shopify.dev/docs/apps/build/…
1
Product data when an AI agent asks for size, material and stock
Don’t. Forget. About. Importance. Of. Adding blablabla
#AI #ArtificialIntelligence #eCommerce #Shopify #AIAgents
1
20
Seven AI chats can now help run a Shopify store: @ChatGPT , @claudeai, @GeminiApp, @grok, @perplexity_ai, Muse, @MSFTCopilot.
For common tasks, the AI uses predefined Shopify actions. For the rest, it writes the instructions itself, and Shopify says results vary more. 🧵
2
1
46
What I’d check this week:
1. Which AI tools are connected, and through whose account
2. Validation rules on custom fields
3. Consistent product data across the catalog
4. What breaks if a field changes
5. Who reviews store changes
1
3
The work is shifting from building admin screens to keeping store data clean and protected. That’s the layer every AI depends on.
Shopify’s docs on all AI connectors:
help.shopify.com/en/manual/a…
2
💡 Sell the way your customers buy, not the way that’s convenient for you
Kim Gandhi, COO at Food Fire + Knives, on why understanding when and how your customers buy can matter as much as your price.
#entrepreneur #business
1
24
Full episode: piped.video/wqA5x1UhCGM?si=Re4B…
⚡️ One booking per week per chef as the key metric
⚡️ How 24/7 concierge support lets chefs focus on cooking
⚡️ Breaking into new cities from zero
21
Petr Kvasnicka, CEO at Father's Coffee Roastery, joined Jack on our podcast to talk about building a specialty coffee business 🎯
⚡️ Why focus beats expansion as a business grows
⚡️ Services and barista training as half of what a roastery sells
⚡️ How a long-term producer partnership protected supply during a shortage
Watch: piped.video/0io4fF8v_wg
#entrepreneur #business
1
25
Claude Code now runs several tasks in parallel from one conversation.
You describe everything in one message. Claude routes it to threads, runs them in the cloud, and pings you when it needs a decision.
Projects now run from one conversation, starting in Claude Code. You describe what needs doing, and Claude directs parallel threads that keep working after you close your laptop.
In beta today for select Pro and Max users in cloud sessions; coming to all Claude users soon.
1
2
46
Agents take over the execution. Control stays with you.
A vague brief used to cost you one bad answer. Now it costs you five threads going in the wrong direction at once.
1
1
23
So the real skill isn't writing code. It's setting boundaries:
→ Define "done" upfront
→ Decide what the agent can touch
→ Set where it must stop and ask
Beta for select Pro and Max users. #ClaudeCode
1
6