Shopify Partner Governance report samples
Two documents from one Shopify Partner Governance engagement: the penetration test report and the Independent Incident Report. They are the pair a platform asks for when an app is suspended and going through reinstatement, and they are what you would receive from us.
Both are illustrative. The client, the application, the findings and every date, domain and address in them are fictional. What is real is the structure, the method and the evidence standard.
What the two reports are
- Penetration test report, v2.0. Two scopes, the embedded merchant admin and storefront widget, plus the backend API, webhooks and app proxy. Findings carry reproduction steps, the request and response, business impact and remediation guidance, and each one is indexed against the Level 1 and Level 2 control lists. This is the v2.0 issue, so every finding also carries its fixed state after the retest.
- Independent Incident Report, v1.0. Scope of impact, root cause with supporting evidence, the incident timeline, and mitigation and remediation. This is the independent leg a reviewer reads alongside the test. Your own incident record stays yours, because only you hold the timeline, the logs and the change history; this report is our assessment built on top of it.
Three limits, published here rather than discovered later
- Shopify does not require a penetration test to list an app. We say so on every page about this programme. What the API License and Terms of Use require is proof of compliance on request, systems configured to Internet industry standards, and a 24 hour breach notification. Testing is one way to produce that proof, not a mandate you are failing to meet.
- The control index shows coverage. It does not evidence the controls. The sixteen Level 1 and Level 2 controls contain no testing requirement, so indexing findings against them shows a reviewer where each control was touched. The policies and records behind those controls stay yours to hold.
- Shopify alone decides reinstatement. No security firm sits in that decision or can commit to its outcome, and we quote no success rate on platform reviews. Treat any vendor who does as describing someone else's decision.
If your app is down right now, the first thing to do costs nothing and is not buying anything from us: ask your Shopify contact in writing what evidence they want.
Get both reports as PDFs by email
The two PDFs are sent on request and read by a founder first, so you get a reply from a person rather than an autoresponder. Tell us where you are with Shopify and a founder will come back on scope as well.
Scope and price for a Shopify engagement are on the Shopify Partner Governance page. What Shopify actually requires, from its own documents, is in the security requirements breakdown. For a general-purpose engagement rather than a Shopify one, the penetration test report example is readable in full on the same terms.