Report vulnerabilities with GitHub private security advisories. Production deployments must verify Shopify HMAC on the untouched request bytes, authenticate the shop, encrypt durable records, minimize personal data and keep both secrets server-side.