If your app company is applying to or renewing its place in Shopify’s Certified Technology Partner Program, penetration testing is an explicit security requirement. Shopify requires an annual independent third-party security penetration test of your application following OWASP and NIST methodologies. That rule is specific to this program; it should not be read as a blanket annual testing requirement for every app in the Shopify App Store. A well-scoped test helps identify exploitable vulnerabilities and gives your engineers evidence for fixing them before the partner review.
Shopify partner pentest requirements: quick answers
- Who needs the test? Applicants and participants in the Certified Technology Partner Program.
- How often? Annually.
- Who performs it? An independent third party.
- What is tested? The partner’s application, following OWASP and NIST methodologies.
- Is the pentest report a Letter of Validation? No. These come from separate assessment activities.
The governing source is Shopify’s qualification requirements, particularly its security requirements section. Use the current instructions supplied for your own application when planning the review.
What is Shopify’s Certified Technology Partner Program?
The program is a qualification path for technology partners serving Shopify Plus merchants. It assesses more than whether an app works: Shopify sets product, merchant-support, privacy, and security expectations for participating companies. Its annual application test belongs to that specific qualification process.
An ordinary Shopify App Store listing has its own published requirements. Built for Shopify is another designation with separate criteria. Some criteria overlap, but these paths should not be treated as interchangeable. Check which program your company is pursuing before using a general “Shopify partner” checklist to commission a test.
Is penetration testing required for Certified Technology Partners?
Yes. Shopify’s stated requirement has four important parts: the assessment is annual, conducted by an independent third party, covers the application, and follows OWASP and NIST methodologies. An internal security review may improve the app, but it does not satisfy the independence wording on its own. Likewise, a report about only a merchant storefront will not necessarily cover the partner application named in the rule. Shopify states the requirement directly.
The requirement does not prescribe an OWASP checklist version, NIST publication, testing duration, or report template. Resources such as the OWASP Web Security Testing Guide and NIST SP 800-115 can inform the methodology. Confirm submission formats and evidence expectations with your program reviewer.
Major authentication, data-flow, or architecture changes may justify additional assessment before the next cycle. This is a risk-based recommendation, distinct from retesting a finding to verify its fix.
Is vulnerability scanning enough?
Automated scanners can reveal known classes of weaknesses and help a tester cover a large attack surface. On their own, they cannot reliably establish whether one merchant can access another merchant’s records, whether a lower-privilege user can invoke an administrative workflow, or whether an API accepts an invalid business transaction. An application pentest combines tools with manual exploration and validation of these security measures. Ask a provider how it will test authorization and business logic rather than buying a scan and labeling it an independent pentest.
What should a Shopify partner penetration test cover?
Start with the app your company controls: its user-facing interfaces, backend APIs, integrations, webhook receivers, data stores, and relevant supporting services. Map where merchant and customer data enters, how identities and shop context are established, and which components enforce authorization. For a multi-tenant app, the boundary between two merchants deserves explicit test cases. The same concern appears in broader SaaS penetration testing, but the exact scope should follow your architecture.
- Authentication and tokens Do OAuth flows and backend checks verify user and shop context, protect tokens, and enforce the intended session lifecycle?
- Merchant isolation and roles Can a user from one merchant, or a lower-privilege role, access another merchant’s records or privileged actions?
- APIs and business logic Do operations enforce object, property, and function-level authorization and valid workflow steps?
- Webhook processing Are HTTPS deliveries verified and processed for the right merchant, with duplicate events handled safely where relevant?
- Data and supporting services Can an application attack path expose customer data, secrets, storage, administrative functions, or connected services?
For merchant-isolation testing, cover reads, updates, exports, and background jobs that process customer data. Check whether the app enforces shop context throughout each workflow, rather than only at login. A shared backend can route requests correctly in the interface while missing authorization in an API operation. Record untested integrations and environments as coverage limitations.
These are recommended test objectives, not an official Shopify checklist. OWASP’s API guidance helps frame API authorization risks, while Shopify’s webhook guidance explains verification for HTTPS deliveries. Agree on authorized targets, test accounts, rate limits, and safe handling of data before testing. Shopify-managed services are outside your application engagement unless you have separate authorization to test them.
Scope testing around the partner application, merchant boundaries, and data flows. Shopify-managed services remain outside the engagement unless separately authorized.
How does the pentest support the partner security review?
Ask for a report covering scope, dates, methodology, reproducible findings, impact, and remediation guidance. Severity ratings such as CVSS can support prioritization alongside business impact; Shopify does not prescribe CVSS here. Keep remediation owners, the record of fixes, and agreed retest results with the report. These are practical reporting recommendations, not a mandatory Shopify template.
The pentest provider and the program security assessor have different roles. Shopify’s published requirement calls for an independent third-party application pentest; it does not name Leviathan as the mandatory pentest provider. An independent provider can therefore perform the test, with scope and evidence aligned to the review requirements.
Leviathan Security Group’s published process describes the separate security questionnaire assessment and says Leviathan issues the Letter of Validation after a successful review. Shopify makes the final decision on admission or continued participation after reviewing the full application. A pentest report supports this process but does not replace the validation letter or prove every required control. Follow the assessor and submission instructions supplied during your Shopify onboarding.
Independent testing supplies technical evidence. Leviathan handles security validation and its letter; Shopify decides program participation.
How should your organization prepare for the pentest?
What should you provide?
Give the tester a current architecture and data-flow overview, an inventory of in-scope URLs and APIs, API documentation or sample requests, and instructions for authentication. Provide production-like staging where possible, synthetic test data, and accounts for at least two test merchants and the relevant user roles your app supports. This makes cross-merchant and privilege-boundary testing feasible without involving real customer data unnecessarily. Record third-party dependencies and exclusions in a written scope, and identify the engineering contact who can answer workflow questions. Our guide to preparing for an API penetration test expands on the access and documentation a tester needs.
How long does it take?
Work backward from your review date. Active testing is only one part of the cycle: scope agreement, access setup, testing, report delivery, engineering fixes, and any retest all need room on the calendar. The schedule depends on app complexity and your team’s readiness, so agree on milestones and the treatment of retests in the statement of work. If new functionality lands after the test, decide whether its risk calls for added scope rather than assuming that a fix retest covers it.
How much does it cost?
There is no Shopify-set pentest price in the published requirement. A useful quote is based on the number and complexity of endpoints and workflows, roles and merchant contexts, authentication mechanisms, relevant cloud and integration components, reporting needs, and retest terms. Share the actual architecture and access plan with prospective providers so their proposals describe comparable coverage.
Final remarks
Define your application boundary and allow time for fixing vulnerabilities and verifying the results. Blaze provides Shopify partner penetration testing, with program validation handled separately. Talk to an expert about scope, evidence, and scheduling for your review.
For related assurance work, see our SOC 2 penetration testing requirements guide.
