How to Choose an Independent Shopify App Security Tester

Write down the actual buying problem before asking for quotes. Is your app delisted after a reported incident, or is Shopify asking for an independent assessment during a review? Record the named app, the requested reports and the response deadline. If the notice asks for both an Incident Report and VAPT, do not assume one combined scan document answers both requests. Investigation and penetration testing examine different questions and may require different access.

Send a redacted version of that requirement list to each candidate. Ask which deliverables their proposal includes, who owns each one and what information is needed before dates can be confirmed. Compare like-for-like scopes rather than choosing the smallest headline price. A proposal covering only the public website is not equivalent to one covering an embedded app, backend APIs, merchant isolation and relevant integrations.

Ask who will perform the assessment and whether they developed the affected application, previously implemented its controls or have other relationships that should be disclosed. Independence should be described in the engagement, not treated as an unexplained badge. Clarify whether another firm will subcontract the work and who will sign the final report. This is a buyer’s due-diligence exercise, not a statement that Shopify endorses a particular accreditation or supplier.

Request evidence supporting any claimed qualifications and confirm that it belongs to the assessor or organization being proposed. A training certificate, methodology reference and company certification mean different things. Avoid relying on an unrelated logo as proof of technical coverage. If a notice names a qualification or assessor condition, ask the candidate how they meet that exact condition and retain the supporting explanation.

Have the tester walk through a representative workflow: installation, authentication, merchant-specific data access, a sensitive API action and a webhook event. Their answer should identify the boundaries your application must enforce. Shopify’s security guidance covers common vulnerabilities; your assessment should translate relevant risks into tests for your own implementation, rather than treating the marketing website as the entire product.

For example, discuss how two authorized test stores will be used to examine cross-merchant object access without exposing real merchant records. Ask how backend-only endpoints, staff roles, token handling and failed installation states enter the scope. Testing Shopify’s infrastructure itself is not automatically authorized by your agreement. Confirm ownership and permission for every target, including cloud services and third-party integrations.

Ask for a permissioned sample or an illustrative report outline with no client data. Look for a precise scope, environment, dates, tested roles, methodology and limitations. A useful finding connects the affected asset to reproduction steps, evidence, plausible impact and practical remediation. A severity label without that reasoning is difficult for engineers to use and difficult for a reviewer to interpret.

Check how the report distinguishes manual validation from automated observations. Ask what happens when an endpoint cannot be tested or logs are missing. For incident work, confirmed events should be separated from hypotheses and unknowns. Never ask another customer’s unredacted report to be shared with you. The ability to protect sample evidence is itself relevant when selecting someone who will handle your incident material.

Before access is granted, define approved accounts, stores, environments, test windows and activities that are prohibited. Specify how material findings are escalated, who can authorize a pause and how evidence is transferred securely. Agree an expiry and revocation process for temporary access. Production testing needs explicit safety limits, particularly where actions could affect orders, billing, inventory or merchant communications.

Retesting should be a named activity rather than an ambiguous promise. Ask which findings it covers, what remediation version will be tested, what dependencies could prevent verification and how open or partially fixed issues will be reported. Clarify the commercial terms and number of rounds in writing. Do not infer that all future testing is included because a page says “retest”; the agreed scope controls the engagement.

Create a short comparison record for each candidate with scope, assessor identity, sample quality, safety arrangements, deliverables, dependencies, communication and retest terms. Mark unanswered questions before selecting a vendor. An honest explanation of evidence limits is more useful than a guaranteed review outcome. Shopify retains its governance decision, and no assessor can promise that commissioning a test will restore a listing.

Scantra Security can discuss independent Shopify app VAPT, available incident evidence, remediation guidance and retesting against your notice. Use the notice intake to establish the problem and scope, then evaluate the proposal using the same criteria you apply to other candidates. The anonymised recovery example on the service page is evidence of a past engagement, not proof that every app follows the same path or achieves the same outcome.