Shopify requires all paid apps to offer a minimum 3-day free trial via the Billing API so merchants can evaluate the app before being charged.
appSubscriptionCreate is called in server/billing.js but the trialDays parameter is absent. The field must be set to at least 3 before submission. Current mutation omits it entirely.
Apps must permanently delete all merchant and customer data when the app/uninstalled webhook fires, unless the merchant explicitly opts in to data retention.
The webhooks/uninstall.js handler only sets deletedAt = new Date() (soft-delete). No hard purge of Shop, Review, or Customer records is performed. This violates the data deletion requirement and would also put the app at GDPR risk.
Every webhook endpoint must validate the X-Shopify-Hmac-SHA256 header to ensure requests originate from Shopify, protecting the app and merchants from spoofed events.
Endpoints /webhooks/orders and /webhooks/customers in server/routes/webhooks.js do not call shopify.webhooks.validate() or any equivalent HMAC check. Only /webhooks/uninstall includes validation.
Theme extensions that store non-essential data in cookies must use the Shopify Customer Privacy API (analytics.subscribe / consent) rather than setting cookies directly, respecting buyer consent preferences.
extensions/theme-reviews-widget/assets/reviews.js calls document.cookie = "cultivaReviews_session=..." directly without first checking Shopify.customerPrivacy.analyticsProcessingAllowed() or waiting for the consent event. This will block approval in markets with GDPR/CCPA enforcement.
Embedded apps must set appropriate Content-Security-Policy headers, including frame-ancestors limiting embedding to Shopify Admin domains, to prevent clickjacking attacks.
server/middleware/security.js sets X-Frame-Options: DENY but does not set a Content-Security-Policy header. The Shopify CLI-generated boilerplate includes this via helmet; it appears the dependency was removed or the middleware was not wired up correctly.
Apps can only mention "Shopify Plus" in their listing if the developer is enrolled in the Shopify Plus Partner Program or the feature genuinely requires a Plus store.
The draft App Store listing (shopify.app.toml description field) includes "Optimized for Shopify Plus merchants". The codebase shows no Plus-exclusive API usage, and the Shopify Partner account (verified via partners.shopify.com config) is on the standard tier. This claim must be removed or justified.
Cannot fully verify that all three GDPR webhooks (customers/data_request, customers/redact, shop/redact) are registered and have live, accessible endpoints without running the app against a test store.
All three handlers exist in server/routes/gdpr.js and are referenced in shopify.app.toml, but the endpoints return 200 with an empty body rather than executing the actual data operations. Confirm handlers perform real data actions before submission.
All server-side routes serving the embedded app must validate the Shopify session token on every request. Some routes may be using legacy cookie sessions.
server/middleware/auth.js applies session token validation correctly, but 3 routes in server/routes/admin.js call shopify.auth.getSessionFromStorage() (cookie-based) as a fallback when no token header is present, instead of rejecting the request. This pattern may pass legacy stores but fail tokenized sessions.
In-app navigation within the embedded admin must use App Bridge's useNavigate hook or Redirect action, not window.location or standard <a href> full-page reloads.
Most navigation uses useNavigate from App Bridge correctly. However, src/pages/Settings.jsx contains a window.location.href = "/plans" call in the upgrade CTA handler. Cannot confirm if this is ever reachable in embedded context — needs developer verification.
When an app changes its pricing, existing merchants must not be charged the new price without explicit consent and adequate notice (at least 30 days).
No plan migration logic found in server/billing.js. This is only relevant if pricing changes post-launch, but it's worth documenting the migration path before submission to satisfy the reviewer that there's a plan.
Apps that modify the checkout experience must declare and document all Checkout UI Extension targets and verify they don't interfere with the Shopify checkout flow.
The extension directory contains a checkout-ui folder with an incomplete shopify.extension.toml (missing target declaration). Cannot confirm whether this extension is intentionally included or a leftover from scaffolding.
Cannot verify App Store listing assets from the codebase alone. Screenshots must show real, functional UI (not mockups) and must not contain competitor logos or misleading claims.
No listing assets found in the repo. Ensure screenshots in the Partner Dashboard are authentic screenshots and include both admin and storefront views of the app working in a real store.
The privacy policy URL declared in shopify.app.toml must be a live, publicly accessible page before submission.
shopify.app.toml sets privacy_policy_url = "https://cultivasaasstudio.com/privacy" but an HTTP check of the URL returns a 404. The privacy policy page must be published before submission.
pos-ui-extension detected in the extensions directory. Conditional signal not present.
customer-account-ui-extension found in extensions/. Conditional signal not present.
shopify.app.toml. Conditional signal not present.