Jonny Paylor

By day: Head of Development for 5 seven‑figure DTC Shopify Plus stores... by evenings & weekends: building my first public Shopify app for merchants.

[Jonny Paylor @jpaylor]

Prediction: Shopify will soon ship native versioning & backup/restore for major content (products, collections, etc).

The detailed audit log is step one. With AI agents wired in and an agent-focused CLI, a lot more can go wrong, fast.

Backup apps exist, but the API limits what they can restore, and how well.

[Jonny Paylor @jpaylor]

A pet peeve of mine is when a Shopify app's support agent immediately comes back with some generic steps like:

"Log in via an incognito/private browsing tab
Clear their browser cache and cookies
Try logging in on a different browser or device, if possible"

Without them even bothering to check their app logs. Especially when I've given them loads of info up-front and we've already ruled that out.

Its just a copy-paste default response, its lazy and annoying, and it happens a lot 👎

[Jonny Paylor @jpaylor]

@DavisPaipa Is this on the basis that those apps won't have ongoing costs (infra/hosting/support)? Are you thinking along the lines of apps just 'applying' a templated solution as a one-off that is hosted/managed on or by Shopify/Sidekick thereafter?

[Jonny Paylor @jpaylor]

@denniscessan 100%, and it looks like you got the better version too. Depending on brand, some of the emails we received from them contained links asking us to reset passwords and integrations 🤦‍♂️

[Jonny Paylor @jpaylor]

A certain well-known attribution & analytics SaaS just disclosed "unauthorized access to certain internal systems."

Their fix? An email asking customers to click a link, reset their password, AND re-authenticate all their integrations.

After a breach. By email. With a link. Talk about a triple fail! 🤦

🐳 Whales shouldn't be training us to get phished 🎣

[Jonny Paylor @jpaylor]

@austriker27 My instinct is the filled in one especially for looking over at a glance

[Jonny Paylor @jpaylor]

@namboozle @polypane Nice I’ll give it a go thanks

[Jonny Paylor @jpaylor]

@JustasOras I think there has been some assumptions made that these were related to a 'checkout hijack' attack, when its possible many of them are just Shopify doing checks and enforcement for general policy violations or failure to maintain / update to newer APIs etc.

[Jonny Paylor @jpaylor]

It sounds like the Google Cloud outage in europe-west2 is limited to the europe-west-2-b zone? Its not a total outage, anyway.

Our Google Cloud SQL instance in that region triggered failover this morning and has remained online since, because we're paying for high availability.

So it begs the question, why are the likes of Lloyds, HSBC, Royal Mail, Revolut so badly impacted? Surely they're all configured for high-availability 😳?

https://t.co/hwGLidleci

[Jonny Paylor @jpaylor]

@0x15f What I don’t understand and have yet to see explained anywhere is what the actual link is between all these apps are, given so many appear to have been affected and yet dont belong to the same companies/developers? There must be something they’re using or doing in common?

[Jonny Paylor @jpaylor]

I second this. If your product is analytics (or analytics is a big part of your product) and you want anything like realtime filtering or querying data etc. then it probably has to be something like Clickhouse/Tinybird (+ Postgres or similar for the other parts of the app). Unfortunately it also gets more expensive (or run it yourself but it’s still going to cost a fair bit).

[Jonny Paylor @jpaylor]

I hear you but those features like the way auth is handled, while convenient, I believe are a little frowned upon and have their own problems too. There’s an in depth blog post here for example https://t.co/2X9KF2kpp9 but aside from that if its causing you to lock into only one provider then that’s not ideal either :). Your agent can sort building auth for you in a way that works with any Postgres db provider.

[Jonny Paylor @jpaylor]

@austriker27 @PlanetScale You can set up a database for about $5 to try it out, but it’ll scale very well beyond that if you need it to 👍

[Jonny Paylor @jpaylor]

@DsMatie The App Store algorithm probably gives some initial extra weight to new apps because they lack the trust signals of reviews? Otherwise a new app would have no chance (and every app was new some day!)

[Jonny Paylor @jpaylor]

@austriker27 Yes - a dedicated server from Hetzner (server auction). It has 128GB RAM! It’s the way forward. Price depends on what resources you need and varies on availability but well worth a look and money well spent imho. Use your agent to help set it up, too.

[Jonny Paylor @jpaylor]

@0x15f layers is on my radar, I've been following the stuff you've been doing and it sounds great, if the price is right! So there's potential there for us to switch. Its not super high on my current priorities though, and we'd have to re-build some stuff, so I'll follow up later 👍

[Jonny Paylor @jpaylor]

There's a well-known long running Shopify app offering search & filtering functionality that was bought out not long ago, and its new private-equity investor backed owners decided to start charging stores ludicrous prices purely based on their GMV, rather than on features or actual app usage as it was before.

For one of our stores, the app's pricing went from $29, to $58, to $699 in a matter of months.

The store is doing well, but not because of the app - far from it. The app's own analytics literally attributes £0 revenue in their own 'app impact' report. Its a brand that's being going many years, and built up a loyal recurring subscriber base and recurring revenue, the vast majority of whom don't even visit the part of the site that this app operates on. In fact, on that store, we barely use any of this apps' features. We just went with it for a consistent tech stack, as all our other stores use it too. We will be costing them next to nothing to operate - its a small catalogue, and we barely ever speak to their support aside from some initial setup they had to do at their end.

After I argued this case with them, they offered a reduced charge of $300 on the basis they'd stopped counting the recurring revenue. One of our other stores, which is much larger and also has recurring revenue, only pays $69/mo for the same app on a grandfathered plan with more features (yes its a retired plan but it just shows what they used to charge, and that's how that app actually built up a great reputation - offering good value). They refuse to offer that pricing to our smaller store, or do a multi-store deal.

This whole concept of buying up successful apps that built their reputation on offering great value and features, only to then start charging extortionate prices on them while offering less for it, is simply not going to work and is absolutely bonkers tactics in this new age of rapidly growing AI-backed competition. They fail to realise, such stores have many other apps they work with, its an ecosystem, and if they all started charging like that, it simply wouldn't be viable. They somehow forget how much Shopify charges for their plans, and how ridiculous it looks when your app (which offers a small portion of what Shopify does) is trying to charge similar amounts, if not more.

In years to come, these private-equity backed apps will fail, after pumping in investors money, jacking up prices, and wondering why all their customers left. I used to recommend this app to everyone, now I do the opposite. We work on 5 Shopify Plus stores, and I'm now thinking what we do to migrate them all away from that app, and I'm sure others will be too.

Luckily, not all apps are doing that, because some understand that you can't get away with charging whatever you want to exploit a merchants success, you instead have to prove your own value and offer more, not less. This is why I admire what @celispj is doing with https://t.co/dBPByYttg1 and their latest email app too. He gets it. They don't charge Shopify Plus customers more 'just because', in fact everyone pays the same. They don't charge on merchants success. Others out there need to learn and stop taking the piss, or risk extinction.

Usual disclaimer: these are my own personal opinions, not those of anyone I work with or for.

[Jonny Paylor @jpaylor]

It is a really impressive website, I think your team should be proud. There are so many things it gets right, it would take me forever to list them all. I think you'll find more people using it as inspiration going forward ;).

Also, its brave - because you're laying everything out in detail, at a time when some are too scared to do so as it could act as a 'blueprint for AI to copy'. I hope the pros outweigh the cons for you guys with this (I suspect it will, and those who want to copy will always find ways to do it anyway!).