OK, security is a thing in Q4 2026. So here we go:
HMAC-SHA256 is live in Function Studio today. Works in discount functions, cart transforms and cart/checkout validations.
Need to pass a custom discount or build a custom bundle via cart/line property? Just sign it, and nobody can tamper with it.
We’ve got your back!
Saturday morning. A Shopify Plus brand hits uninstall on Function Studio.
60 seconds later they realize a whole pile of their discounts lived inside the app.
Good thing I built point-in-time recovery for function history months ago.
Boring infrastructure work. Saves weekends.
Found Cloudflare's ASNs for IP allowlist in about 3 minutes with Shopify's tooling.
here's how:
- add the Cloudflare ASN
- hit Run test
- check the app Logs for blocked IPs that belong to CF to see its ASN, repeat the sequence
ok so i finally got here.
you can now build an entire promo in FS. storefront to checkout. one flow.
that means:
category + PDP discounts
cart upsells
complex GWPs
storefront + checkout widget builder
cart/checkout validation
scheduling
show different widgets based on conditions. block checkout for customers who don’t qualify. pull data from metafields if you need to.
then schedule the whole thing and go to bed.