Dylan Pierce

I like building stuff on the internet. Maker of Real ID for Shopify, Woo and BigCommerce - and lots of OSS you've never heard of

[Dylan Pierce @ctrlaltdylan]

2nd @Shopify app up and running 🙌

https://t.co/tnaStba3OC

[Dylan Pierce @ctrlaltdylan]

So which frontier lab is going to rewrite PHP internals with Rust as a massive marketing stunt?

[Dylan Pierce @ctrlaltdylan]

@John_Speed @martincox100 Prepare for the worst, that's what I always say.

One day I'll finish my home bunker office

[Dylan Pierce @ctrlaltdylan]

@gideon_b Haha yep. It’s all me. Glad you like Bandit!

[Dylan Pierce @ctrlaltdylan]

Shopify is taking app security seriously too.

Breaches hurt the whole system, not just the individual apps with poor sec policies. How can you trust installing apps if you're seeing others?

Shopify's app security skill is a solid start but there's more you can do:

https://t.co/YNMOhfutHf

[Dylan Pierce @ctrlaltdylan]

@kirplatonov Good stuff!

Makes me wonder if we'll start to see Shopify's sec skill extend to theme linting for unescaped metafields, or potentially just auto-escape under the hood

[Dylan Pierce @ctrlaltdylan]

T minus 1 hour till critical PHP patch release.

I wish they disclosed the affected major version(s)

[The PHP Foundation @ThePHPF]

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

[Dylan Pierce @ctrlaltdylan]

The newest guide on how to harden your app against supply chain attacks, with new tooling available in package managers and integrations to help prevent breaches:

https://t.co/mvXTZMCMAM

[Dylan Pierce @ctrlaltdylan]

Here's a Shopify App Security Field Guide so we can keep up with this changing landscape:

https://t.co/vwQdYnR8eT

I've been publishing new guides and tactics based on what's happening in the ecosystem. Clearly the times have changed, and it's an opportunity to improve

[Dylan Pierce @ctrlaltdylan]

@celispj I'm not seeing an option to apply to the Defense Tier specifically. The form isn't showing an option for "self defense, non-enterprise" type tier.

But you can still use Opus, open weight models, etc to test against your app in CI/CD:

https://t.co/AahsMn3Ulr

[Dylan Pierce @ctrlaltdylan]

@ShopifyDevs @atleeclark @eytanseidman I'll be there!

[Dylan Pierce @ctrlaltdylan]

Finally able to build something that merchants have been asking over and over for years now.

So so excited. Can't share details now but so grateful for the opportunity

[Dylan Pierce @ctrlaltdylan]

@Brian_Peotter Ohio leads the nation in being stuck in Ohio

[Dylan Pierce @ctrlaltdylan]

@ShopifyDevs This is great!

Already integrated. Here's an example of automating these scans in your CI/CD:

https://t.co/SzIseHLeSv

[Shopify Developers @ShopifyDevs]

Merchant trust is everything
Which means security is everything

Introducing `app security check`

A tool that finds common vulnerability patterns in Shopify apps

Run it with AI Toolkit

[Dylan Pierce @ctrlaltdylan]

Confirmed. This fire pit slaps

[Dylan Pierce @ctrlaltdylan]

Ordered a fire pit direct from a local one man shop and manufacturer with Shop checkout to boot

Feels good man

[Dylan Pierce @ctrlaltdylan]

@JordanFinners Haha I’ve been setting a version constant manually for telemetry for awhile now. This is nice

[Dylan Pierce @ctrlaltdylan]

Real runners don’t post to strava

[Dylan Pierce @ctrlaltdylan]

Now it's limited to unit tests only, it doesn't actually mock the UI.

But at least you can test business logic and error edges, which is at least giving you a base line foundation to work from.

[Dylan Pierce @ctrlaltdylan]

I can't believe I missed this.

Now you can write automated tests for your Shopify UI Extensions - including POS 🤯

pnpm i --dev @shopify/ui-extensions-tester

[Dylan Pierce @ctrlaltdylan]

Not rocket science but proud of this new intro page design I launched today.

1. (Hopefully) clear instructions
2. Visual and primary action above the fold
3. Dismissible by power users