- Scan your app with the new AI Toolkit security check to detect Shopify-specific vulnerabilities like unauthenticated routes and unverified webhooks.
- Migrate to short‑lived expiring access tokens now, as they will soon be mandatory for all public apps.
- Enable two‑step authentication, review API logs for suspicious activity, and follow Shopify’s security best‑practice docs.