CUSTOMER STORY – SHOPIFY APPLICATION SECURITY
Incident response and Penetration Testing for the ShineTrust Shopify app
When the Product Labels & Badges Shine app faced operational restrictions following a redirect incident, IPSIP Vietnam helped verify the cause, contain the impact, and conduct in-depth Web/API testing.
Six security findings, including a Critical vulnerability with a CVSS score of 9.0, were remediated and verified through retesting.
Shopify Application
CVSS 9.0
PENTEST
ISO 27001:2022
SOC 2 Type II
BUSINESS CONTEXT AND DEMAND
When a security incident disrupts a Shopify app serving merchants worldwide
Shopify detected unusual redirect activity linked to Product Labels & Badges Shine and restricted the extension’s operation. With storefront features no longer fully functional, ShineCommerce needed to quickly identify the cause, contain the impact, and demonstrate that the application had been securely remediated.
CUSTOMER PROFILE
S
ShineCommerce
Developer of Smind Sections - an application that helps merchants build and customize their Shopify storefronts.
Founded
2012
Customer Reach
Global
Daily Usage
>10,000
customers use the product every day
Product Requiring Penetration Testing
ShineTrust
Product Labels & Badges for Shopify
Challenges to address
3 key requirements following the incident
Identify the cause and scope of impact
Trace the source of the credential exposure, establish how the attacker gained access to the system, and identify affected stores and data.
Contain the incident and remove redirect code
Revoke exposed credentials, isolate the database, and remove malicious content from product descriptions and Trust Badge data.
Validate application security and complete documentation
Conduct comprehensive Grey-box testing of the Web application and APIs, retest remediation measures, and provide technical reports to support engagement with Shopify.
Incident Response
Grey-box Pentest
Web & API
Retest
INCIDENT ANALYSIS
A single information exposure opened two paths for redirect code injection
The investigation found that the redirect code was not originally part of the application. The incident began when sensitive information was included in the frontend and used to access backend systems.
01
Sensitive information was exposed in the frontend
The App Secret and database connection details were included in the client-side JavaScript build.
02
System access was exploited
The attacker gained access to the database and the tokens the application used to interact with Shopify.
Shopify Admin API
Redirect code was injected into merchants’ product descriptions.
Dữ liệu Trust Badge
Records containing redirect content were created in the application database.
STOREFRONT IMPACT
When shoppers clicked certain key buttons, the injected code could redirect them to an attacker-controlled domain.
KEY FINDING
The two attack paths used different data sources. Cleaning product descriptions alone was insufficient; the business also needed to review application data and revoke all exposed credentials.
SCOPE OF IMPACT
Determining the incident’s scope through data
IPSIP Vietnam cross-referenced Shopify API logs, application data, and incident traces to determine the scope of impact for each attack path.
45
stores showed access or probing activity using tokens with read-only permissions
33
Product descriptions
Cleaned before 29 September 2026
Redirect code was found injected into product descriptions.
17
Trust Badge records
Disabled before 3 October 2026
Records containing redirect payloads were found in the application.
Note: The groups of 33 and 17 stores correspond to different attack paths and may overlap. They should not be added together as 50 distinct stores.
INCIDENT RESPONSE & WEB/API PENTEST
Incident investigation, Penetration Testing and remediation verification
IPSIP Vietnam combined incident response with Web/API penetration testing in a single project, containing active risks while simulating real-world attack techniques to uncover weaknesses that could still be exploited.
CONTAIN
02
Contain and clean up the incident
Remove secrets from the frontend, rotate credentials, revoke old tokens, isolate MongoDB, and remove malicious content from product descriptions and Trust Badge data.
REMEDIATE
Remediate and harden the application
04
One Critical and five Medium vulnerabilities were resolved. Server-side input validation, database limits, API protection, and access controls were added.
05
03
01
INVESTIGATE
Investigate the cause and scope
Cross-reference Shopify API logs, source code, application data, and access traces to identify the root cause, the two attack paths, and the scope of affected stores.
PENTEST WEB/API
Conduct in-depth PENTEST
IPSIP Vietnam simulated real-world attack techniques to assess authentication, session management, authorization, input handling, database, APIs, and business logic risks.
RETEST & VERIFY
Retest and verify remediation
IPSIP retested each finding, confirmed that all 6/6 vulnerabilities had been remediated, and added daily checks to detect potential recurrence.
Combining incident response with Web/API penetration testing helped ShineCommerce address the immediate symptoms and identify, remediate, and verify the resolution of weaknesses that could enable another attack.
PENTEST & INCIDENT RESPONSE RESULTS
Weaknesses identified, remediated and retested
IPSIP Vietnam conducted Web/API penetration testing after containing the incident. One Critical and five Medium vulnerabilities were identified, remediated, and confirmed as Fixed through retesting.
6/6
PENTEST FINDINGS FIXED & VERIFIED
All security findings within the penetration testing scope were successfully remediated and retested.
38 minutes
CRITICAL RESPONSE
The Stored XSS vulnerability with a CVSS score of 9.0 was remediated and retested within 38 minutes of IPSIP’s alert.
Web + API
PENTEST SCOPE
Testing covered authentication, authorization, database, APIs, input handling, and business logic.
0 secret
PRODUCTION BUNDLE
No sensitive credentials remained detectable in the production frontend bundle.
Daily
CONTINUOUS CHECK
Cleaned resources are rechecked to detect potential recurrence.
Penetration testing confirmed that the vulnerabilities had been resolved. The database was also isolated, malicious content was removed, and measures were established to prevent recurrence.
RISK SELF-ASSESSMENT
Could your business systems have a similar chain of risks?
Individual weaknesses can combine into an attack chain, particularly in SaaS applications that use APIs, tokens, and data displayed on customer systems.
01
Secrets exposed in the frontend
Server-side credentials may be accidentally bundled into JavaScript and become externally accessible.
REVIEW NEEDED
02
Internal services accessible from the Internet
Databases, APIs, or administration interfaces may lack appropriate network restrictions, authentication, and authorization.
REVIEW NEEDED
03
Tokens with broad permissions stored in the database
If the database is compromised, these tokens could be used to perform actions on connected platforms.
REVIEW NEEDED
04
Backend data rendered directly on the storefront
Content without proper sanitization and output encoding can become a channel for delivering malicious code.
REVIEW NEEDED
05
Remediation completed without retesting
Removing malicious code does not prove that the root cause and all attack paths have been addressed.
REVIEW NEEDED
Why did ShineCommerce choose IPSIP Vietnam for Penetration Testing?
IPSIP Vietnam combines incident response and security testing expertise to help businesses resolve immediate issues and reduce the risk of recurrence.
Combining incident response and security testing
IPSIP supports the entire process - from root cause verification and impact assessment to in-depth Web/API testing - within a single project.
Testing focused on real-world Risks
Penetration testing focuses on authentication, authorization, session management, input handling, database, APIs, and business logic - areas that can directly affect users and business operations.
Clear, actionable Findings
Each finding is classified by risk level, includes a description of its impact, and comes with specific recommendations. IPSIP Vietnam continues to support remediation and retesting to verify the results after fixes are applied.
Capabilities validated against international Standards
ISO 27001:2022 certification and a SOC 2 Type II attestation report demonstrate IPSIP’s commitment to controls, information security, and service delivery quality.
Strong and trusted cybersecurity protection
IPSIP combines the expertise of its security team with a solution ecosystem from SentinelOne, CrowdStrike, Fortinet, and Sekoia. Based on the required scope, suitable solutions are selected to support security monitoring and the detection and management of threats to business systems.
This approach strengthens data protection, supports stable operations, and improves response capabilities when security risks emerge.
TELL US ABOUT YOUR PROJECT
...And our team will:
Review your request within 1–2 business hours.
Provide a detailed proposal based on your project’s specific scope and requirements.
Arrange an in-depth call to discuss your project and finalize the most suitable approach.
Sign the service agreement and officially launch the project with you.
Don’t have specific requirements yet but want to learn more about our capabilities? Visit About IPSIP Vietnam to discover more about our team’s expertise.
