Skip to content

Remove lax Shopify API key secret check - #8503

Open
francisbeaudoin wants to merge 1 commit into
Shopify:mainfrom
francisbeaudoin:remove-lax-shopify-api-key-secret-check
Open

Remove lax Shopify API key secret check#8503
francisbeaudoin wants to merge 1 commit into
Shopify:mainfrom
francisbeaudoin:remove-lax-shopify-api-key-secret-check

Conversation

@francisbeaudoin

@francisbeaudoin francisbeaudoin commented Sep 8, 2026

Copy link
Copy Markdown

Why

App doctor currently treats any api_key, client_id, or SHOPIFY_API_KEY assignment containing 32 hex characters as a hardcoded Shopify API key. That pattern is too broad and can flag generic/public 32-character identifiers, such as public client IDs in application code

What changed

  • Removed the generic Shopify API key secret pattern.
  • Removed the special-case exemption for shopify.app*.toml client IDs because it is no longer needed.
  • Updated the secret safety tests to assert generic 32-character hex client IDs are not reported.
  • Kept Shopify API secrets and prefixed Shopify token detection intact.

Testing

  • pnpm vitest run packages/app/src/cli/services/app-doctor-engine/tests/secret-safety.test.ts
  • pnpm prettier --check packages/app/src/cli/services/app-doctor-engine/rules/secret-rules.ts packages/app/src/cli/services/app-doctor-engine/tests/secret-safety.test.ts .changeset/remove-shopify-api-key-secret-check.md

Copilot AI lite review requested due to automatic review settings September 8, 2026 23:13
@francisbeaudoin
francisbeaudoin requested a review from a team as a code owner September 8, 2026 23:13

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The change is narrowly scoped, aligns with the stated goal, and is covered by updated tests; remaining feedback is minor precision/wording.

Pull request overview

This PR narrows App Doctor’s secret detection to avoid false positives by removing the heuristic that treated any api_key / client_id / SHOPIFY_API_KEY assignment containing 32 hex characters as a hardcoded Shopify API key, while keeping detection for Shopify API secrets and prefixed tokens intact.

Changes:

  • Removed the generic 32-hex “Shopify API key” detection pattern from committed-secret scanning.
  • Removed the now-unneeded special-case exemption for shopify.app*.toml client IDs.
  • Updated secret safety tests and added a changeset documenting the user-facing behavior change.
File summaries
File Description
packages/app/src/cli/services/app-doctor-engine/rules/secret-rules.ts Removes the generic Shopify API key pattern and the shopify.app*.toml exemption path.
packages/app/src/cli/services/app-doctor-engine/tests/secret-safety.test.ts Updates fixtures/assertions to ensure generic 32-hex client IDs are not reported as secrets.
.changeset/remove-shopify-api-key-secret-check.md Documents the user-visible reduction in false positives as a patch changeset.
Review details
  • Files reviewed: 3/3 changed files
  • Comments generated: 2
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

'@shopify/app': patch
---

Remove app doctor detection of generic 32-character Shopify API keys.
Comment on lines 280 to +285
const secrets = result.issues.filter((issue) => issue.id === 'COMMITTED_SECRET')
expect(
secrets.some((issue) => issue.location.file === 'shopify.app.toml' && issue.title.includes('Shopify API key')),
).toBe(false)
expect(secrets.some((issue) => issue.location.file === 'shopify.app.toml' && issue.title.includes('API key'))).toBe(
false,
)
expect(secrets.some((issue) => issue.location.file === 'shopify.app.staging.toml')).toBe(false)
expect(secrets.some((issue) => issue.location.file === 'app.js')).toBe(true)
expect(secrets.some((issue) => issue.location.file === 'app.js')).toBe(false)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants