Shopify checkout hijack: our apps are not affected, and why the attack pattern does not reach them

Between 10 and 14 October 2026 shoppers on a number of Shopify stores were sent to fake checkout pages that collected card details. The redirect did not come from Shopify and not from the stores' themes. It came through third-party apps: an unauthorized party changed the configuration of Hulk Product Options, Selleasy and Swym Wishlist Plus and placed a script into the storefront code those apps render on the affected stores. Qikify reported the same pattern from July. The vendors have published their findings, and the developer Roman Zipp keeps a summary of their statements.

Since then several merchants have asked us whether any of our apps could be used the same way. That is the right question to ask every app vendor, and it deserves an answer you can file.

Our answer

No. None of our apps was involved in this campaign, and none of them can place a script of this kind in your storefront.

That covers Workflow Trigger Extensions, Workflow Webhooks, Workflow Transactional Email, Workflow Functions, Workflow Suite, Workflow Forms and Workflow Documents. We checked each of them against the pattern of the attack: storefront code that loads whatever an app's configuration says, changed by someone who got into that configuration. Here is what we found.

• Four apps run nothing in your storefront. Workflow Webhooks, Workflow Transactional Email, Workflow Functions and Workflow Documents work entirely between Shopify's servers and ours: no theme app extension, no app embed, no script tag, nothing a shopper's browser ever loads.
• Two apps add a web pixel, and only if you switch a storefront trigger on. Workflow Trigger Extensions and Workflow Suite use Shopify's web pixel in its strict sandbox for their storefront triggers. The sandbox has no access to the page: the pixel cannot read or change what the shopper sees and cannot redirect anyone. It reports events to us, and nothing flows the other way.
• One app shows something in your storefront: Workflow Forms. Its form block, popup and form page are a theme app extension whose script is a fixed file we ship. The theme block and the popup load it from Shopify's CDN, the form page loads the same file through Shopify's app proxy. The script loads your form definition and nothing else, and every text in it, including the HTML block, is rendered through an allow-list of harmless elements: links, emphasis, lists, headings, tables and images. A script, a style or an event handler never reaches the page, whatever the definition contains.
• Our configuration cannot be changed from the internet. We have no support console, internal tool or script runner with a public address. Production is reached by named people through Google Cloud IAM, and every change to an app goes through the pipeline described on our security page before it ships.

Where to find this later

Security at Code Creation Labs now carries a table of the advisories we have been asked about, with the date, whether our apps are affected and a link to the statement, so you can check it before writing to us. This campaign and PHP2Shell are the first two entries. Each app's help center has its own security page with the same table and the app's specifics, and every privacy policy links to it.

If you have a security questionnaire to complete, or an advisory you would like us to check against our apps, write to support@codecreationlabs.com. We answer those with priority.