Shopify app audit case study

16 findings. A clear plan for Built for Shopify.

A public Shopify app team needed to know whether its release was ready for submission. My independent audit identified six high-severity findings and recommended postponing the application, with a prioritized remediation plan and verification checklist.

16 technical findings77 criteria assessedPrioritized plan

Request an app audit

Adapted, anonymized audit excerpt

Code audit · UI finding · Medium severity

Save errors disappeared after five seconds.

Observed: The editor cleared save errors after five seconds, even when the problem remained.
Recommended change: Keep the error visible until correction or dismissal, with a clear way to retry.
How to verify: Force a failed save. After ten seconds, check that the explanation and recovery action remain.

The challenge

An audit before applying for Built for Shopify.

The team maintained a public Shopify app with a merchant-facing editor and wanted an independent assessment before applying for Built for Shopify. I reviewed one identified release in two passes, covering its code, configuration, and the applicable requirements.

I recommended postponing submission for the reviewed release. The team received a ranked list of fixes and a checklist for the remaining Partner Dashboard and live-session checks. The client remains anonymous; the examples below are adapted from the completed audit.

This case study covers the completed audit. The fixes and retests described are recommendations; completed remediation or Built for Shopify approval is not claimed.

Inside the report

Findings from the merchant interface.

Three of the eight medium-severity findings.

Save errors disappeared too soon

Observed: General save failures were cleared automatically after five seconds, regardless of whether the problem was resolved.
Why it matters: A merchant could miss the failure and lose the explanation needed to recover.
Recommended change: Retain the error until correction or explicit dismissal, explain the problem near the relevant field, and provide retry where appropriate.
How to verify: Force a failed save, wait ten seconds, and check that the explanation and recovery action remain available.

Queued edits lacked navigation protection

Observed: The editor used debounced autosave without a Contextual Save Bar or a navigation guard.
Why it matters: Leaving before the save queue finishes could lose an edit. This timing risk still required verification in a live embedded session.
Recommended change: Integrate save, discard, and navigation handling. If keeping autosave, confirm the approach with Shopify and demonstrate that queued edits cannot be lost.
How to verify: Test immediate navigation, failed save requests, and rapid changes across sections in an embedded session.

Primary actions diverged from Shopify Admin

Observed: A primary action used a custom green style rather than the expected Shopify Admin treatment.
Why it matters: Inconsistent actions make the interface less familiar and were a design mismatch in the requirements snapshot used for this audit.
Recommended change: Align primary actions with the appropriate Shopify components and design tokens.
How to verify: Check primary actions in embedded desktop and mobile sessions for consistent treatment and clear states.

The assessment

What the audit found.

The 16 code findings were ranked by technical impact. The separate BFS assessment recorded requirement status. Severity and application priority are different: a medium-severity UI issue can still need fixing before submission.

Code audit

6High

8Medium

2Low

Sixteen findings, each with supporting evidence, a recommended fix, and a verification step.

BFS snapshot · 77 criteria

15Pass

13Fail

10Verify

35N/A

4Conditional fail

The method

How I reviewed the app.

Each conclusion states what the review established and what still needed checking outside the source code.

01 · Inspect
Review one release
Inspect architecture, security, privacy handling, Shopify integration, release checks, and configuration against one identified code version.
02 · Verify
Run focused local checks
Test selected behaviors with synthetic data, without changing Shopify, database, or production data. Record the limits of each check.
03 · Map
Assess the BFS requirements
Record every criterion as Pass, Fail, Verify, Not applicable, or Conditional fail. Explain the evidence behind each assessment and what would change it.

The 77-item scorecard reflects the requirements snapshot used for this audit on 6 September 2026. Shopify’s current requirements remain authoritative.

Current BFS requirements

What was delivered

What the team could work from.

Technical audit

A severity-ranked list of findings, with supporting evidence, recommended changes, and tests for each fix.

Criteria matrix

All 77 criteria assessed, with code findings separated from checks requiring dashboard or live-store evidence.

Review record

The exact release reviewed, checks performed, review limitations, and evidence still to collect.

Submission checklist

What must be fixed, retested, and demonstrated before submitting the reviewed release.

The roadmap

Recommended fixes before submission.

Stage A
Protect core workflows
Fix the highest-impact engineering and data-handling findings first. Test failure cases as well as successful workflows.
Stage B
Make the interface ready for review
Address the UI findings and verify the merchant workflows in embedded desktop and mobile sessions.
Stage C
Verify the release being submitted
Make release checks repeatable, confirm which version is deployed, and collect the missing Partner Dashboard evidence.

Built for Shopify readiness

Know what stands between your app and the application.

The independent full code audit costs EUR 699 per app. You receive first findings in about 5 working days and the full written report in about 10 working days, with evidence, a 77-point readiness matrix, and a prioritized remediation plan. Shopify approval is not guaranteed.

See the audit scope Download the free 2026 guide

Independent Shopify app review

Know what to fix before you apply.

Tell me about your app and where you are in the review process. I’ll reply personally by email with the proposed scope and next steps.