> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bouquet-inc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Bouquet Inc. approaches the security of its Shopify apps, and security notices such as the impact of the PHP vulnerabilities known as PHP2Shell (CVE-2026-109618, CVE-2026-109619).

## Our approach

To help store owners use our apps with confidence, we check whether newly disclosed vulnerabilities affect our apps, and we review our apps with Shopify's official security check. We post the results and the status of our response on this page.

## Notices

**2026-10-22**

On October 21, 2026, two vulnerabilities in PHP known as PHP2Shell (CVE-2026-109618, CVE-2026-109619) were disclosed. Here is how they affect our apps.

**None of our five public apps are affected**.

| Question | Answer |
| - | - |
| Do the apps use PHP on the backend? | No |
| Are the apps affected by these vulnerabilities? | No |
| Is a fix required? | No. No action is needed on your store for our apps |

Apps covered: Discount Deck, MultiLikes, User Tag Plus, LLMs.txt Generator, AI MCP ChatBot

These vulnerabilities were found in PHP itself and can allow an unauthenticated attacker to run arbitrary code remotely. All five of our apps are built without PHP.

Reference: [PHP security advisories (php-src)](https://github.com/php/php-src/security/advisories)

**2026-10-22**

We ran "shopify app security check", the official security check provided by Shopify, on our five public apps (Discount Deck, MultiLikes, User Tag Plus, LLMs.txt Generator, AI MCP ChatBot).

The check found no issues rated "Critical".

For the items recommended for improvement, we are working to complete our fixes by the end of October 2026. We will post an update on this page once the work is complete. You can continue to use the apps as usual.

Reference: [App security checks (Shopify)](https://shopify.dev/docs/apps/build/security/app-security-checks)

If you have any questions about security, please contact our [support desk](https://bouquet-inc.channel.io/home).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.