Identity verification for Shopify Partners starts today

3 Ways AI Powers Service Desk Attacks and How to Prevent Them

AI is making service desk social engineering attacks more convincing, personalized, and scalable. Attackers use generative AI for realistic phishing emails, call scripts, and deepfake impersonation, while also leveraging AI-driven reconnaissance to gather employee details from LinkedIn, job posts, and social media. Onboarding is a particularly vulnerable window since new employees are unknown to IT teams. Three defensive measures are recommended: secure password delivery via enrollment links instead of SMS/email, biometric liveness detection to defeat deepfake impersonation, and mandatory identity verification before sensitive actions like password resets. The piece is sponsored by Specops Software and promotes their Secure Onboarding product.

Updated App Store Requirements: 1.3 Always Use Honest and Transparent Review Practices

Shopify is updating its App Store policy 1.3 on honest and transparent review practices. The changes clarify enforcement around incentivized reviews, with consequences including review removal, app demotion or delisting, and Partner account termination. Additionally, Shopify is adjusting its logic to filter out fake and untrusted reviews, so only reviews meeting trust standards will be publicly visible. Developers should use the Reviews API to collect authentic reviews and request reviews only in neutral language without offering any incentives.

Your Summer Holiday Has More Security Checks Than You Think

Modern travel relies on layers of invisible digital security infrastructure. Bots now account for 53% of all web traffic (40% malicious), making travel booking platforms prime targets for credential stuffing, price scraping, and fraudulent reservations. At airports, e-gates use cryptographic certificates and biometric matching on electronic passport chips to verify identity in seconds. Hotel digital check-ins move guest data across cloud systems, mobile apps, and third-party services — yet only 34% of organizations fully know where their data lives. Public Wi-Fi and banking app usage while traveling expose consumers to further risks, with 68% of people having abandoned a company due to trust issues with its digital services. Encryption, access controls, and data governance are the tools keeping convenience and security in balance across the travel journey.

Shopify Flow: Action runtime URLs now update automatically

Shopify Flow now dynamically resolves action runtime URLs on every execution instead of hard-coding them at workflow activation time. When an app is redeployed with a changed runtime URL, existing workflows automatically pick up the new URL without merchants needing to re-save or reactivate them. This also applies during local development with shopify app dev. No action is required from developers, but those who relied on the URL remaining fixed until reactivation should be aware of the new behavior.

Mass Assignment and the Identity Drift: From Profile Edit to Insurance Takeover

Một nhà nghiên cứu bảo mật phát hiện lỗ hổng mass assignment trong API cập nhật hồ sơ của nền tảng, cho phép ghi đè các trường nhận dạng nhạy cảm (tên pháp lý, ngày sinh, số CMND) mà vẫn giữ trạng thái eKYC đã xác minh. Lỗ hổng này dẫn đến "identity drift" (trôi dạt danh tính) và có thể leo thang thành chiếm quyền kiểm soát hồ sơ bảo hiểm bằng cách thao túng trường ngày sinh trong logic khớp chính sách.

Lập trình viên nên đọc bài này để hiểu cách một lỗ hổng mass assignment có thể biến đổi dữ liệu xác thực người dùng thành công cụ tấn công hệ thống tài chính, y tế hoặc chính sách bảo hiểm, và cách phòng ngừa bằng cách kiểm soát trường nhập liệu và phân cấp quyền tin cậy.

Shopify Flow: Changes to Action extensions result in fewer breaking changes

Shopify Flow is changing how breaking changes to Action extension configuration fields are handled. Previously, any field mismatch caused runtime validation to fail and prevented requests from reaching partner servers. Now, workflows using older action versions will continue to execute, and Shopify will forward the request to the configured endpoint regardless of schema differences. Developers must update their endpoints to gracefully handle payloads that may have missing required fields, extra legacy fields, or other schema mismatches — using strategies like default values, ignoring unknown fields, or returning clear error responses.

POS UI extensions 2026-07 uses per-unit fixed-amount line item discounts

Shopify POS UI extensions API version 2026-07 changes how fixed-amount line item discounts work. Previously, apps could pass a total discount for the entire line item and Shopify POS would auto-convert it to a per-unit value. Starting with 2026-07, the value passed is interpreted directly as a per-unit discount — no automatic conversion occurs. For example, passing '5.00' on a quantity-2 line item now results in a $10.00 total discount, not $5.00. Apps on 2026-04 or earlier are unaffected; apps migrating to 2026-07 must update their discount calculations to pass per-unit values explicitly. Percentage discounts are not affected.