Hardened Shopify store-domain validation when connecting

Fix

Week of June 22, 2026

We tightened how the Shopify integration handles your store domain during the connect/authorization flow.

Strict *.myshopify.com check — the store domain is now validated everywhere authorization begins, including App-Store-initiated installs, and malformed or crafted values are rejected before any redirect.
One source of truth — every entry point that connects a store now shares the same validation, so the behavior is consistent.

No admin action required — connecting a legitimate Shopify store works exactly as before.