Our approach
To help store owners use our apps with confidence, we check whether newly disclosed vulnerabilities affect our apps, and we review our apps with Shopify’s official security check. We post the results and the status of our response on this page.Notices
Our apps are not affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619)
On October 21, 2026, two vulnerabilities in PHP known as PHP2Shell (CVE-2026-109618, CVE-2026-109619) were disclosed. Here is how they affect our apps.None of our five public apps are affected.
Apps covered: Discount Deck, MultiLikes, User Tag Plus, LLMs.txt Generator, AI MCP ChatBotThese vulnerabilities were found in PHP itself and can allow an unauthenticated attacker to run arbitrary code remotely. All five of our apps are built without PHP.Reference: PHP security advisories (php-src)
We ran Shopify's official security check
We ran “shopify app security check”, the official security check provided by Shopify, on our five public apps (Discount Deck, MultiLikes, User Tag Plus, LLMs.txt Generator, AI MCP ChatBot).The check found no issues rated “Critical”.For the items recommended for improvement, we are working to complete our fixes by the end of October 2026. We will post an update on this page once the work is complete. You can continue to use the apps as usual.Reference: App security checks (Shopify)