Hi! 👋

I think today’s email will be very long. We have so much to talk about.

About what’s happening in the ecosystem, what I’ve been working on, what’s coming, etc.

Today:

• Shopify Apps removed due to security issues

• My feedback on ShopQuest

• Emails & Flows feature on App Store Pulse

• The Wide Event 2027

• DOT TCG fun project

Enjoy!

Want to learn how to grow your Shopify App with this Blueprint?

I share everything from building and making $0 to growing and selling for 7-figure. You don’t need to be the best developer or the best marketer.

14-day money back guarantee

Shopify Apps removed due to security issues

If you’ve been around X or LinkedIn, you probably saw it already:

Many apps have been removed from the Shopify App Store. 🥶

And the main reason was: security issues.

So what concretely triggered that? I’ll share the details here and explain how I handle that and monitor it.

AI makes it easier to code, but also easier to find vulnerabilities when you’re a hacker.

It seems many Shopify Apps (including my own app, WideBundle) were targeted by these hackers, who tried to find vulnerabilities.

And if you haven’t checked yet, your app is probably a target too.

But some apps had issues that let hackers inject JavaScript code into merchants’ stores.

The goal was to redirect the store’s checkout to a fake one to steal visitors' money.

One important point, though. Over the last few days, we've seen many people say that 100 apps were removed because of that. Or we even saw numbers like 400 apps.

Shopify removes apps from the App Store when it detects a vulnerability. It’s a way for them to protect both the merchants and the apps.

But it's important to understand that not every app removed from the App Store was removed because of this specific vulnerability, or even because of a security issue.

Apps get removed from the App Store every month for all kinds of reasons. It's been happening for years. This is nothing new. 🙅‍♂️

Here are things you have to check:

• Every page, endpoint and webhook verifies Shopify’s signature

• One store can never see or change another store’s data

• Install and billing links are signed and links expire

• Merchant input can’t run as code anywhere

• Secrets never appear in code, logs or public scripts

• Server software is patched and private files (like .env) can’t be downloaded

• Databases, etc., aren’t public.

This is what I do to monitor if something bad is happening:

• Keep full access logs

• Log refused requests and errors in a database

• Have your AI write a check script for errors, installs, webhooks and orders

• Run it every 30 minutes and it reports when something is wrong

• If something’s off, have your AI trace that IP address in the access logs

• Close the hole if you find something

• When a new security flaw is announced, have your AI check if you’re exposed

My feedback on ShopQuest

I didn’t have the time to do it before.

Shop Quest was on October 3rd, and we’re already 3 weeks after. Sorry about that!

The first thing I can say is that Indians are really passionate about what they do.

They are really enthusiastic so it’s awesome to talk with them about it. You can really see how much they love what they’re doing.

And like last year, I was very well welcomed!

The main event (ShopQuest) itself was great, I really liked the way everything was presented (and honestly, I might borrow some of it for The Wide Event 👀)

But not only did I attend ShopQuest, I also did my first Indian wedding! What an experience haha

And I didn’t forget all the other events around.

Honestly, it was a great experience! I enjoyed it more than last year because I stayed longer this time.

I’ll definitely come back next year if there is another edition!

Emails & Flows feature on App Store Pulse

You can now email the stores using your app, directly from App Store Pulse.

It's not a generic email tool. It knows what each store does in your app and what it pays you.

Here's what you can do with it:

• Send a welcome series the day a store installs

• Nudge stores 3 days before their trial ends

• Ask why, the same day a store uninstalls

• Announce a feature only to the stores it matters to

It plugs straight into your app. Your app sends its events (an install, a plan change, anything you track) and your flows start on their own.

And since your Shopify Partner account is connected, every store comes with its billing data: plan, trial, monthly spend, LTV, install date. Build a segment like "on trial, ends within 3 days" and it keeps itself up to date.

Then the part I like most.

Every email is tied to revenue. When a store clicks an email and then subscribes, upgrades or comes back within 30 days, you see it on that email. So you know which campaign and which flow actually make money, not just which ones get opened.

You can try it now on https://appstorepulse.com

The Wide Event 2027

I visited the venue of The Wide Event last week and I already kind of know how the event will be

I can’t share pictures yet or an official date.

But it will be in May 2027!

So think about it: in May, you’ll be in Paris.

DOT TCG fun project

You know, it has been complicated for Shopify Apps recently.

So I thought, why not create a fun little project that could bring some fun?

You can access it there: https://dottcg.com

What is it?

It’s a fun TCG (Trading Card Game) around the Shopify Partners ecosystem.

In simple terms, you open packs and inside you have cards.

Cards represent things or people that everyone in the ecosystem knows.

It’s 100% free, go check it 😄

No specific ambition behind it, it really is just a fun project.

Have you tested App Store Pulse yet? 👀

If you didn’t, you can click here: https://appstorepulse.com

Have a great day!

Mat