Your store's safety comes first: how we upgraded Reelv security this October

October is Cybersecurity Awareness Month. This year it also arrived with a hard reminder for everyone in the Shopify ecosystem. Several recent incidents involving third-party apps have hit merchants where it hurts most: their storefronts, their checkouts and their customers' trust.

If you run your store on Shopify, every app you install becomes part of your store. That is a real responsibility for app makers. So rather than waiting, we spent the last few days taking a hard look at Reelv from top to bottom and tightening everything we found.

Here is what we did, in simple language.

The short version: You don't need to worry about anything. Reelv is safe to keep using, and every change below is already live.

1. We audited every part of Reelv

We reviewed the Reelv app itself, our video processing pipeline, our background jobs and our email service. We looked at who can call what, what each part trusts, and what would happen if someone tried to misuse it. Every finding went on a tracked list, and we worked through it item by item, testing each fix on our staging environment before releasing it to production.

2. Nothing runs without proof of who is asking

• Every internal service now requires authentication. Our video, job and email services only respond to Reelv itself. Anonymous requests are refused.
• Every message from Shopify is verified. Webhooks (like "order paid" or "product updated") and storefront requests are checked against Shopify's cryptographic signature before we act on them. Forged requests are rejected.
• Admin actions need a logged-in merchant. Deleting or changing your content only works from your own authenticated Shopify admin session.
• We removed old endpoints that were no longer needed. Code that doesn't exist can't be attacked.

3. Your analytics can't be faked

Reelv shows you which videos drive sales. We now confirm every attributed purchase against the real order in your Shopify store before counting it, and we validate and size-limit all tracking data. On top of that, public tracking endpoints are rate-limited, so nobody can flood them to distort your numbers or slow your store down.

4. Your storefront stays clean

The recent incidents were about malicious code ending up on storefronts and checkouts. We made sure Reelv can never be a path for that. Every setting you can type into the Reelv widget (headings, labels, colors and so on) is now safely escaped before it reaches your storefront. Text shows up as text and can never run as code.

5. Your data stays private

• Our databases are reachable only from our private network. They can't be reached from the public internet at all.
• Our public endpoints don't reveal internal error details to anyone outside.
• We support Shopify's privacy requests in full. When a customer asks for their data, or asks for it to be deleted, or when a store uninstalls Reelv, we handle it through Shopify's official privacy (GDPR) webhooks.
• We checked who has been accessing your store. We reviewed our Shopify API access logs and confirmed the requests to merchant stores come from Reelv's own servers only.

6. Up to date, top to bottom

• We moved Reelv to the latest Shopify Admin API version.
• We upgraded our software dependencies to patch known vulnerabilities, and turned on automatic security alerts for all our code.
• We rotated our internal keys.
• Two-factor authentication is on for our team accounts, and we reviewed exactly who on our team has access to Reelv's Shopify app settings.

What's next

Security isn't a one-time project. Next on our list:

• moving to Shopify's newer expiring access tokens, so any token is only valid for a short time;
• upgrading our server runtime to the latest version;
• further tightening of our cloud infrastructure.

We'll keep auditing Reelv regularly, not just in October.

What we'd suggest to every merchant

A few habits that protect your store, whichever apps you use:

• Turn on two-factor authentication for everyone with access to your Shopify admin.
• Review your installed apps from time to time and uninstall the ones you no longer use.
• Give staff accounts only the permissions they need.
• Be wary of anyone asking you to paste code into your theme or checkout.

Questions?

If you have any question about Reelv and your store's security, or want to report a concern, write to us at team@reelv.live. We read every message.

Your store, your data and your customers' trust matter more to us than anything else we build. Video commerce should help you sell, never put you at risk.

— The Reelv team