Shopee can require integration providers to submit a penetration test report as evidence that their applications protect platform and buyer data. The applicable conditions depend on your developer category, requested access, partner status and Shopee’s instructions. Establish which review your report must support before commissioning testing.
Shopee Open Platform connects third-party applications to orders, product listings and shipping workflows. Those integrations may process buyer data across many merchant accounts, making their own security central to protecting customer information. For independent software vendors and integration teams preparing for Shopee review, this guide explains applicability, CREST provider selection, testing scope, report evidence and submission. Resolving these questions early helps avoid rework and delays to data-dependent features.
When does Shopee require penetration testing?
Start with the purpose of Shopee’s request. Sensitive-data access has a documented report submission process, while contractual requests and partner-program reviews need to be checked against their own conditions. Your company’s location alone does not determine the answer.
| Review or request | What to establish before testing |
|---|---|
| Access to sensitive data | Whether your developer category and seller markets fall within the access guide’s report requirement. |
| Service Partner Program review | The security documents required for your account and partner status, including any provider and renewal conditions. |
| A direct request from Shopee | The stated scope, approved-provider conditions, deadline and submission route. |
Sensitive-data access requirements
Shopee’s sensitive-data access guide requires reports for ISVs serving or planning to serve sellers in Thailand, Malaysia, Singapore or the Philippines, and for China Cross-Border and Hong Kong Cross-Border ISVs. This list defines that particular access process; it is not an exhaustive list of where Shopee may request pentests.
Contractual requests and partner-program conditions
Under section 8.4 of Shopee’s Data Protection Policy, Shopee can request a pentest report with reasonable notice, using a third-party vendor it approves, at the developer’s cost. This is a separate basis for requesting testing.
For the Service Partner Program, check the current security-document criteria applicable to your account. Preserve Shopee’s notice and give it to your assessor so the proposal addresses the correct review. Confirm the required deliverables, accepted provider credentials and renewal schedule together.
What must the penetration test report contain?
For the sensitive-data access process, Shopee’s guide sets out these report expectations. Compare them with any additional instructions attached to your own request:
| Area | Expectation |
|---|---|
| Coverage | External attack surface and relevant in-scope systems. |
| Method | Black-box pentesting; a scan alone is insufficient. |
| Evidence | Methodology, process, scope and complete findings. |
| Remediation | Confirmation that all vulnerabilities are fixed. |
| Provider | CREST is among the recommendations; alternatives considered individually. |
Turn those expectations into deliverables before signing the proposal. We recommend agreeing the following evidence with your provider:
| Testing question | Evidence to request |
|---|---|
| Did the test cover the integration? | Named applications, APIs and infrastructure; environment, dates and exclusions. |
| Could a user cross a seller boundary? | Tested roles and seller relationships, with reproducible evidence for any unauthorized access. |
| What was exposed, and why does it matter? | Affected records or functions, demonstrated impact and severity rationale. |
| Did the fix work? | Original finding, remediation status, correction tested, retest date and outcome. |
This evidence checklist is our practical recommendation. Keep fixed findings visible with their final remediation status so reviewers can follow what changed.
Does Shopee require a CREST pentesting company?
Shopee explicitly recommends CREST-accredited penetration testers. Its current provider guidance also lists other credentials and providers, including OSCP and GPEN, and permits case-by-case consideration of alternatives. It does not establish a universal CREST-only rule for every integration.
Check precisely what your request specifies. Company accreditation and an individual tester’s certification are different credentials. Verify the provider’s penetration testing accreditation and the qualifications of the assigned team separately. Neither automatically proves Shopee has approved that vendor for your account.
Also check the separate Service Partner Program requirements before procurement. Do not assume the provider criteria or renewal conditions for one Shopee process apply unchanged to another.
Manual testing and automated vulnerability scanning
Ask penetration testers how they investigate application behavior beyond automated detection. Manual testing can explore seller isolation, authentication and business logic that require knowledge of the workflow. Automated tools support identifying vulnerabilities; the assessment must validate their impact. Our pentesting versus vulnerability scanning guide explains the distinction.
How to scope and commission the assessment
Map buyer data from seller authorization through order processing, storage and exports. Identify the web application, APIs, background services and infrastructure involved. For each component, record ownership and inclusion in the assessment. A storefront-only scope could leave the order-processing backend unexamined. Compare API documentation with deployed routes to identify undocumented or legacy endpoints that also need testing.
For a Shopee integration, our scoping discussion would normally consider:
- Authentication and access controls. Assess login, session handling, user permissions and separation between merchant accounts.
- Credentials and tokens. Where are integration secrets held, who can retrieve them, and how does the application associate access with the correct seller?
- Background processing. Do callbacks, queues, scheduled jobs and exports preserve the intended permissions?
- Data storage and input handling. Investigate SQL injection where relevant, exposed backups, insecure configuration and downloadable files containing buyer data.
- Supporting infrastructure. Which exposed services and administrative interfaces could provide another route into the integration?
Consider a hypothetical order-management application. Seller A generates a shipping export. The application checks permissions when creating the file, but its download endpoint does not check who owns the export. Seller B can request the file by changing its identifier.
This illustrates broken object-level authorization, a risk identified by OWASP. The assessment needs to investigate the permissions around the exported object, not merely confirm that users can log in. Relevant evidence would show the intended boundary, the unauthorized request and the information exposed.
API penetration testing can investigate these relationships across users, roles and workflows. For the example above, we would recommend supplemental authenticated testing with separate seller test accounts. Describe that work separately from the black-box component: additional credentials change the access available to the tester. Confirm the combined assessment plan against Shopee’s instructions before execution.
Agree ownership and authorization for every target. The engagement should identify your application and supporting systems, the permitted environment, exclusions and operational limits. Connecting to Shopee does not authorize testing Shopee’s infrastructure.
What affects cost and preparation?
Request a quote against an asset inventory and workflow description. Endpoint count is one input; roles, seller relationships, background processing, infrastructure and testing depth also affect the work. Check whether reporting and fix validation are included, and what happens if remediation takes longer than expected.
Provide the testing team with Shopee’s request, your architecture, relevant API documentation and an engineering contact. Agree an escalation route for urgent findings and reserve development time for fixes. Our API pentest preparation guide covers the access and documentation arrangements in more detail.
How to submit the report and plan continued access
Use a developer account in Console: Personal Center → Account Information → Security Reports & Certifications Information. Add a penetration-test report, upload it and save. Member accounts cannot upload; review typically takes ten working days. Follow Shopee’s submission instructions.
Separately, applications needing buyer PII require the PII declaration and relevant server IP addresses.
Before uploading, check that the document corresponds to the application being reviewed and contains the agreed final evidence. Assign someone to monitor the submission and coordinate any questions with the assessor and engineering team. Keep a copy of the submitted version so later discussions refer to the same report.
Build the project schedule around distinct milestones: testing, remediation, fix validation, report delivery and platform review. These activities depend on different people. Booking a pentest close to a launch deadline can leave little room for engineering changes or follow-up questions.
Report age, validity period and renewal
Shopee recommends a report issued within the past year; approved sensitive-data access runs for two years from report issue.
For example, submitting a six-month-old report does not restart the access period. Track report issuance separately from submission and approval, and assign an owner for renewal. Review other program commitments before setting the next assessment date; also record material application changes that could make existing evidence less representative.
How much does a Shopee integration pentest cost?
Blaze’s one-off web application and API pentest packages start at US$4,999 for Lite. Essentials, our most popular package, starts at US$7,499, while Assurance starts at US$8,999 for deeper testing. These are package starting prices; the quote for your Shopee integration depends on the agreed scope.
Essentials and Assurance include one fix-validation round within 90 days; Lite offers it as an add-on. Factor that into your budget when preparing remediation evidence. Multiple applications, additional roles or broader infrastructure may require a custom assessment. Compare package scope and inclusions, then share Shopee’s request with us to confirm which option covers the required work.
Scope your Shopee integration pentest
Bring your architecture, requested data access, Shopee instructions and deadline to the scoping conversation. Blaze can help define the assessment and deliver validated findings through manual pentesting, with AI assistance where useful. Agree the reporting and fix-validation work at the start so engineering knows what to prepare.
