Dylan Pierce

I like building stuff on the internet. Maker of Real ID for Shopify, Woo and BigCommerce - and lots of OSS you've never heard of

[Dylan Pierce @ctrlaltdylan]

2nd @Shopify app up and running 🙌

https://t.co/tnaStba3OC

[Dylan Pierce @ctrlaltdylan]

Allowed network hosts for extensions:

https://t.co/MlsXHqHFrj

[Dylan Pierce @ctrlaltdylan]

New Shopify app security improvements:

1. Lock down merchant access tokens to allowed IP addresses
2. Lock down network requests to your known hosts in extensions

I dig it. Reduces risk surface area. If a token were compromised, the attacker still needs server access

[Dylan Pierce @ctrlaltdylan]

Allowed IP addresses for access tokens:

https://t.co/O1VfSJDbCo

[Dylan Pierce @ctrlaltdylan]

@ShopifyDevs Would be neat if there was some way to hook up an agent directly to the changelog so we can subscribe to relevant updates

[Dylan Pierce @ctrlaltdylan]

So which frontier lab is going to rewrite PHP internals with Rust as a massive marketing stunt?

[Dylan Pierce @ctrlaltdylan]

@John_Speed @martincox100 Prepare for the worst, that's what I always say.

One day I'll finish my home bunker office

[Dylan Pierce @ctrlaltdylan]

@gideon_b Haha yep. It’s all me. Glad you like Bandit!

[Dylan Pierce @ctrlaltdylan]

Shopify is taking app security seriously too.

Breaches hurt the whole system, not just the individual apps with poor sec policies. How can you trust installing apps if you're seeing others?

Shopify's app security skill is a solid start but there's more you can do:

https://t.co/YNMOhfutHf

[Dylan Pierce @ctrlaltdylan]

@kirplatonov Good stuff!

Makes me wonder if we'll start to see Shopify's sec skill extend to theme linting for unescaped metafields, or potentially just auto-escape under the hood

[Dylan Pierce @ctrlaltdylan]

T minus 1 hour till critical PHP patch release.

I wish they disclosed the affected major version(s)

[The PHP Foundation @ThePHPF]

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

[Dylan Pierce @ctrlaltdylan]

The newest guide on how to harden your app against supply chain attacks, with new tooling available in package managers and integrations to help prevent breaches:

https://t.co/mvXTZMCMAM

[Dylan Pierce @ctrlaltdylan]

Here's a Shopify App Security Field Guide so we can keep up with this changing landscape:

https://t.co/vwQdYnR8eT

I've been publishing new guides and tactics based on what's happening in the ecosystem. Clearly the times have changed, and it's an opportunity to improve

[Dylan Pierce @ctrlaltdylan]

@celispj I'm not seeing an option to apply to the Defense Tier specifically. The form isn't showing an option for "self defense, non-enterprise" type tier.

But you can still use Opus, open weight models, etc to test against your app in CI/CD:

https://t.co/AahsMn3Ulr

[Dylan Pierce @ctrlaltdylan]

@ShopifyDevs @atleeclark @eytanseidman I'll be there!

[Dylan Pierce @ctrlaltdylan]

Finally able to build something that merchants have been asking over and over for years now.

So so excited. Can't share details now but so grateful for the opportunity

[Dylan Pierce @ctrlaltdylan]

@Brian_Peotter Ohio leads the nation in being stuck in Ohio

[Dylan Pierce @ctrlaltdylan]

@ShopifyDevs This is great!

Already integrated. Here's an example of automating these scans in your CI/CD:

https://t.co/SzIseHLeSv

[Shopify Developers @ShopifyDevs]

Merchant trust is everything
Which means security is everything

Introducing `app security check`

A tool that finds common vulnerability patterns in Shopify apps

Run it with AI Toolkit

[Dylan Pierce @ctrlaltdylan]

Confirmed. This fire pit slaps

[Dylan Pierce @ctrlaltdylan]

Ordered a fire pit direct from a local one man shop and manufacturer with Shop checkout to boot

Feels good man

[Dylan Pierce @ctrlaltdylan]

@JordanFinners Haha I’ve been setting a version constant manually for telemetry for awhile now. This is nice