EVDEV

Shopify & Shopify Plus builds for brands that outgrew their theme. Configurators, B2B, CRO, custom apps. 180+ stores shipped. Toronto.

[EVDEV @EVDEVagency]

1. Nobody sets out to build a slow, fragile Shopify store. It happens one app at a time.

Some notes on when apps stop being cheap, and when a custom app (or no app at all) costs less.

[EVDEV @EVDEVagency]

@JustPigmentsAZ Duo chrome must be so hard to show in a photo. Do you use short videos on the product pages? Feels like the color shift is what sells it.

[EVDEV @EVDEVagency]

@mustafa01ali @Shopify Day one support, nice. The storefront side is the next question: a phone that opens wide lands on a screen width most Shopify themes were never tested on. Worth a check before Black Friday.

[EVDEV @EVDEVagency]

@TechWith_Nova Same here, the voice is always where it falls apart. Did review kill them because it sounded fake, or because it didn't sound like your brand?

[EVDEV @EVDEVagency]

@vvsjeweler 24 pairs in 60 days is a serious run. Do people buy after seeing them online, or do most want to see them in person first?

[EVDEV @EVDEVagency]

@stoychev @consentmo Respect for posting this openly. Merchants trust the apps that explain what happened, not the ones that go quiet.

[EVDEV @EVDEVagency]

@denk_tweets Same with stores. Every app you install, you're now its security team too.

[EVDEV @EVDEVagency]

@MLProduce Smart call taking it offline instead of hoping. Hope you're back up soon, the lambs deserve a working store

[EVDEV @EVDEVagency]

The FBI just flagged two critical PHP bugs, Node.js shipped 10 security fixes, and stores are taking sites offline.

On Shopify, servers are Shopify's job. Yours is what you added:
- apps with order and customer access
- staff without 2FA
- custom code on your own servers

[FBI Cyber Division @FBICyberDiv]

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[EVDEV @EVDEVagency]

Shopify just invested in Whop, a platform that launched its own ecommerce product on Oct 1.

Platform wars are over. The winners plug into each other.

For brands the question isn't which platform anymore. It's whether your products, data and checkout can travel.

[Steven Schwartz 🦅 @cultured]

Whop has raised $200M in Series D funding at a $5.1B valuation, backed by @sequoia and @shopify.

It really feels like we are barely touching the tip of the iceberg in a market larger than anyone can imagine.

We first launched Whop as a better way for us to sell sneaker bots, one of the most niche types of desktop software out there.

Total TAM? Probably $20,000 per day.

Who cares, tiny market.

But, what people discounted is the idea that there were actually 70,000 other markets exactly like that one.

Beyond the investment itself, I am especially excited to welcome legendary silicon valley investor @dougleone to our board of directors. Doug and the sequoia team are nothing but a brilliant, resourceful, and principled group of people.

My co-founder Cameron and I started building on Shopify when we were 13 years old. Shopify is one of the most impactful all-in-one cloud ecosystems ever created; @tobi has pioneered modern entrepreneurship the way we know it and we are thrilled to have him in our corner.

We have a tenet at Whop to be the dumbest in the room and I am very grateful that this has recently become a lot easier.

We are focused on markets, scale economies, and progressive media. If that is up your alley, please message me directly.

The $200M raised will support our expansion as we build economic infrastructure for the next century, continuing on our mission of delivering everyone an income.

[EVDEV @EVDEVagency]

@immarkwilliam Bundles on the first order are the cleanest fix. Bigger first basket, profit on day one.

[EVDEV @EVDEVagency]

@janwhyy So the swatch moved online. Shade matching on the product page is doing a lot of heavy lifting now.

[EVDEV @EVDEVagency]

@janwhyy What usually gets someone on that list? Want to make sure we never end up there.

[EVDEV @EVDEVagency]

@zachmstuck Which brand? A $20-30 AOV at that spend means the site converts like crazy. Would love to see the PDP.

[EVDEV @EVDEVagency]

@dave_stickland Same hit rate as the paid statics is the wild part. Do they all point to one PDP, or does each angle get its own page?

[EVDEV @EVDEVagency]

@OisinO Respect for saying it out loud. Merchants mostly see "delisted" and panic. Knowing it's usually a fix, not a death sentence, helps.

[EVDEV @EVDEVagency]

@janwhyy Probably bought the repeat customers, not the revenue. Retention is what makes a CAC like that okay

[EVDEV @EVDEVagency]

@RobbyFrank Does Claude touch the store itself too, like theme changes and PDP tests, or only the marketing around it?

[EVDEV @EVDEVagency]

@ValoriLuca The 0-order days are the ones nobody posts about. Congrats on not quitting.

[EVDEV @EVDEVagency]

@ValoriLuca At 5,000 orders a day, what broke first on the store side? Checkout, apps, or the sync with fulfillment?

[EVDEV @EVDEVagency]

Quick way to check: Settings → Apps → sort by last used. Anything you haven't opened in 90 days is a candidate.

[EVDEV @EVDEVagency]

Shopify has delisted 135+ apps in the last few weeks, some after security incidents.

Good moment for a 10-minute app audit:
- Which apps can read customer and order data?
- Which ones did you stop using but never uninstalled?