Know when your
store's code changes.
Apps and tags bring new code into your storefront. Skyfense visits your Shopify store like a shopper, records the scripts it loads, and flags changes with patterns that could put customer data at risk.
Home · catalog · product · desktop cart · mobile cart
See the change.
Review the evidence.
Record the scripts
A synthetic shopper visits key pages, hashes external script responses, and archives the code. First-seen scripts become the approved baseline automatically.
Compare later versions
Changed scripts produce findings with code diffs. Common Shopify apps and tags receive vendor labels to help your team understand where code came from.
Triage and document
Keep a finding open, acknowledge it, or resolve it after investigation. Accept reviewed changes as a new baseline and export evidence per finding.
Payment fields.
Unexpected listeners.
Skyfense checks changed code for payment-field keywords, packed or obfuscated content, and execution or data-exfiltration patterns. Combinations of payment keywords and suspicious patterns raise critical findings.
Runtime hooks also observe listeners on payment and password fields and heavy use of dynamic code execution. Critical findings go to your configured email or webhook for investigation.
Findings are risk indicators for review. Monitoring does not automatically remove code or certify that a storefront is safe.
A clear baseline.
A defined scope.
Audits cover the storefront journey listed above. Do not assume they inspect every page or the hosted payment checkout.
Existing scripts are approved when first seen. Inline scripts are not compared, and runtime evidence covers only the last page in each pass.
Use scheduled audits or start one from Scripts. Theme-publish-triggered audits and editable script rules are not available yet.
Script monitoring questions
What the auditor sees, how findings work, and the limits of the beta.
What does a storefront audit visit?
The auditor visits your Shopify home page, catalog, a product page where it tries Add to cart, and the desktop cart, then revisits the cart with a mobile viewport. Audits run hourly and can also be started from the Scripts page.
Will it find malicious code already on my store?
The first time a script is seen, it becomes the approved baseline automatically. Monitoring looks for later changes; it does not establish that your starting code is safe. Inline scripts are not compared, and runtime observations cover only the last page of each desktop or mobile pass.
Can I review and export a finding?
Yes. You can inspect the archived script and its diff, acknowledge or resolve a finding, accept a reviewed version as the new baseline, and export JSON evidence for each finding.
Does monitoring remove suspicious scripts?
No. It surfaces findings for investigation and sends critical findings to your configured alert email or webhook. Your team decides how to respond. Monitoring is currently in beta for Shopify stores.
Is this the same as automation detection?
They cover different risks. Automation detection checks a visitor’s browser for bot signals. Storefront script monitoring checks changes to the scripts loaded by your store.