Shopify removed your app and did not say why. That silence is deliberate, and it is published.
From the enforcement page: “to protect the privacy and security of our merchants and Partners, we can’t share specific information about an investigation unless required by law.”
So you cannot ask what happened and expect an answer. What you can do is narrow it, because the causes are published even when the verdict is not. This page lists every reason we could find in Shopify’s own documents, what each one requires, and which of them involve security at all.
For most of them the answer is that security has nothing to do with it. That matters, because the wrong diagnosis costs days you do not have.
First: which state are you actually in?
Shopify runs five states with five different routes, and they are routinely spoken of as one thing. The route back depends entirely on which one you are in.
| State | What it means | Route back |
|---|---|---|
| Paused | Blocked before a reviewer saw it | Resubmit. “you can resubmit by click Submit fixes in the status banner” |
| Reviewed | Needs discussion with your reviewer | Reply to the email |
| Suspended | Submission privilege withdrawn | ”you can resubmit your app for review on the date shown in the status banner” |
| Quality check | A published app failing a periodic check | Remediation with evidence, on a 30 day clock |
| Delisted | Enforcement action against a published app | Appeal only. No resubmission route is published. |
🔴 If you are delisted, the appeal is probably not the instrument you think it is. Its stated trigger is “If you believe that there has been a mistake.” That is a channel for disputing a finding of fact. If you have accepted the finding and fixed the fault, nothing published tells you where that submission goes.
The one cause that delists automatically, and has nothing to do with security
An unsupported API version. This is the only technical cause where Shopify prints delisting as an automatic consequence:
“If your app continues to use unsupported resources after the upgrade deadline, it’s delisted from the Shopify App Store. Users are blocked from installing it for a minimum of seven days, and they’ll see warnings in the Shopify admin until seven days after the last detected use of unsupported resources.”
Check this first. It is self-diagnosable in minutes, the fix is a migration rather than an investigation, and the route back is self-serve: stop the unsupported calls and the block lifts after seven days. No appeal, none offered, none needed.
Two traps make it easy to miss:
Shopify falls forward silently. “If your app targets an inaccessible version, Shopify falls forward and responds using the oldest accessible stable version.” Your app keeps working while the condition that delists it accrues. The only signal is a response header that differs from the version you asked for.
The call may not be yours. “Deprecated calls are attributed to the app whose access token made them, so don’t use an app’s access token outside the app.” A support engineer running an old query from Postman with your token raises the alert against your app.
Shopify releases a version quarterly and supports each for a minimum of 12 months. Your Dev Dashboard flags deprecated calls and the deadline for fixing them.
Policy and listing reasons
This family is large, and none of it involves security work. It is a documentation, copy and process problem.
The reasons include circumventing checkout or payment processing, falsifying data such as fake reviews or false purchase notifications, publishing apps substantially identical to your own others, pre-selecting optional charges that raise the checkout total, re-ordering shipping options so the cheapest is not default, off-platform billing, and listing-content rules covering pricing accuracy, screenshots, trademark use, statistics and superlatives, and review solicitation.
On reviews specifically, Shopify is explicit about the consequence: “Developers violating these policies may face consequences such as the removal of reviews, demotion or delisting of your app, or termination of your Partner account.”
Route back: before publication, fix and resubmit. After publication, the enforcement path, which is appeal only.
🔴 One that catches honest developers: “Apps that no longer reflect the original core functionality submitted to the App Store will be re-evaluated and will need to be resubmitted for a full App review.” Shipping your way into a different product is a published cause, and the remedy is a full re-review rather than a correction.
Quality checks: the clock most people miss
If your app is live and Shopify opens a quality check, two deadlines start:
“If you don’t respond to the initial quality check within 7 days, then your app will be demoted. If you fail to make required changes to your app within 30 days, then your app might be unpublished.”
And the route through is documented:
“After you make the changes, submit your response in the Partner Dashboard and provide evidence of the changes that you’ve made. A member of our App Excellence Team will review your app.”
🔴 This is the only place in Shopify’s documentation with a published route for submitting remediation with evidence on a live app, and it sits before delisting rather than after it. Shopify does not say what counts as evidence and does not ask for a third party. An independent assessment is one admissible form of evidence. It is not a requirement, and anyone telling you otherwise is inventing one.
Protected customer data
Sixteen requirements across two levels. Level 1 covers data minimisation, consent, retention periods and “Encrypt data at rest and in transit.” Level 2, which applies if you touch name, address, phone or email, adds encrypted backups, separated test and production data, a data loss prevention strategy, limited staff access, strong passwords, an access log, and “Implement a security incident response policy.”
That policy is the only security artefact Shopify mandates by name anywhere in its documentation.
Shopify may select you for a data protection review. The selection criteria are published, loosely: apps with high install counts, high volumes of customer records, more approved protected fields, or long retention. The evidence specification is one sentence: “you’ll need to provide evidence that your app and your practices meet the protected customer data requirements.”
🔴 Shopify does not publish what happens if you fail one. No revocation, no timeline, no re-review, no appeal. The document is silent, and that silence falls back on the general discretion to remove any app at any time for any reason.
Security incidents: real obligations, no published way back
If Merchant Data is breached or you suspect it has been, the API License and Terms of Use is specific and the clock is short:
“notify Shopify of any actual or suspected breach or compromise of Merchant Data… no later than twenty-four (24) hours of becoming aware… at your own cost, you will: (A) promptly remedy the Data Breach…; (B) investigate the incident; (C) take reasonable actions to mitigate…; and (D) promptly answer questions from Shopify.”
🔴 Three reporting destinations are published and they disagree. The API Terms, which carry the contractual duty, name the Shopify Support partners help page. The security best practices page says security@shopify.com. The October 2026 blog post says partner-security-reports@shopify.com. Use the contractual one, copy the others if you want speed, and do not lose hours deciding.
What gets the listing back after a confirmed compromise: nothing is published. Not an appeal, not a cure period, not a re-review, not an evidence format. The Partner Program Agreement goes further in the other direction, allowing account termination “without notice to, or recourse for, Partner.”
This is the one family where investigation and remediation are genuinely required, named in the contract, and billed to you.
What Shopify says about its own security check
Shopify ships a free static check, shopify app security check, and recommends running it before submission and on every release. It also publishes what the check does not do:
“The checks read your app’s source code. They don’t test your app while it runs, so a clean result isn’t proof that your app is secure. Use them alongside your existing security tools and reviews.”
That is Shopify describing the boundary of its own tool. Static analysis of source is not a test of the running system, and Shopify says so rather than leaving you to discover it.
The five things app review itself checks are published: protection against common web vulnerabilities including the OWASP Top 10, a valid TLS certificate with no self-signed certificates, no unnecessary public services (Shopify runs Nmap to find open ports), tokens generated with 128 bits of entropy, and a correct Content Security Policy frame-ancestors directive against clickjacking. Each failure is a rejection with the same route back: fix it and submit for another review.
Two dated obligations worth putting in your calendar now
“Starting January 1, 2027, Shopify will reject GraphQL Admin API requests that use a non-expiring offline access token.”
“Script tags are deprecated and will stop running on storefronts on March 1, 2027.”
Both carry a required label in Shopify’s own headings. Neither is a security engagement. Both will take an app down if missed.
What to do today
- Check your Dev Dashboard for deprecated API calls. Minutes, and it rules in or out the one cause that delists automatically.
- Read the notice you were sent. It comes from
ecosystem-governance@shopify.com, which Shopify states “isn’t actively monitored”, and you reply to that email rather than opening a support ticket, because “Shopify Support is unable to provide updates on these tickets.” - Ask your Shopify contact, in writing, exactly what evidence they want. It costs nothing and it is the only reliable source on your specific case. It beats every general recommendation, including this page.
- Work out which family you are in before commissioning anything. Four of the five need no security work at all.
If you are in the fifth, our Shopify Partner security testing page sets out what we scope and what it costs, and the evidence an incident report and an independent assessment each have to carry is on its own page. Shopify decides the outcome. No security firm sits in that decision or can commit to it.
Sources. Enforcement of Shopify’s Partner Program Policies; Shopify Partner Program Agreement; Shopify API License and Terms of Use; About Shopify API versioning; App Store requirements; About app quality checks; About the app review process; Work with protected customer data; About app security; App security checks; Following security best practices; Privacy law compliance; Securing your app, together. All read 22 October 2026. The enforcement page carries no revision date of its own, which is worth knowing for a document this consequential.