Shopify Admin API access tokens are stored in macOS Keychain under the service name codex-shopify-multi-store. The JSON configuration contains store aliases, domains, and API versions only.

Never commit Shopify access tokens, OAuth client secrets, .env files, or a legacy stores.json file containing credentials.

Use the narrowest Shopify Admin API scopes required for each store. Treat every mutation as a production change and verify the selected store first.

Do not open a public issue for a suspected vulnerability. Use GitHub's private security advisory feature for this repository.

Include the affected version, reproduction steps, impact, and a minimal test case. Do not include live credentials or customer data.

The maintainer targets an acknowledgment within three business days. The maintainer targets an initial assessment within seven business days.

These targets are not a contractual service-level agreement. Remediation time depends on severity, complexity, and disclosure coordination.

The maintainer will credit reporters unless they request anonymity.