Shopify makes IP allowlisting mandatory for all public apps to curb stolen token abuse
POLICYShopifyredteam/daily · 1 source
- Severity
- Low
- Sources
- 1
What happened
Shopify has made IP allowlisting mandatory for all public apps to limit the abuse of stolen API access tokens, announcing the change on 5 November. Restrictions for applications using bulk operations start on 12 November. Developers must specify the public IP addresses their apps use, so a token used from outside that list should be rejected. No CVE is associated with this change.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Developers of public Shopify apps should specify the public IP addresses their apps use.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Companies