In partnership with
The market intelligence most desks are missing.
CEOs, politicians, regulators, and analysts talk for hours on podcasts every day.
Particle actively transcribes 125,000+ podcasts and turns them into structured data, available over REST API or MCP, searchable within minutes of airing.
Track a company or person by name, with each mention cited to the exact quote, speaker, and timestamp, or search for commentary on a thesis or sector with semantic search.
Particle is built by former Twitter and Tesla engineers, using an AI-native transcription pipeline that delivers high accuracy and extensive data enrichment.
Editor's Note
Over the last few months, we've seen several security stories involving Shopify apps that are worth paying attention to.
Not because Shopify is becoming less secure.
Something more interesting is happening.
Apps are becoming more powerful, while security ownership is still treated as an implementation detail.
A 4.9-star, Built for Shopify app reportedly had Shopify and Facebook credentials exposed through an unsecured infrastructure component.
Security researchers continue to find basic webhook authentication mistakes.
And Shopify itself is changing its authentication model, moving all public apps toward expiring offline access tokens by January 2027.
Those aren't disconnected events.
They point to a bigger shift in the ecosystem.
Shopify Apps Have Become the New Security Perimeter
Why app security is becoming a founder problem, not just a developer problem
Hello Founders,
Inside Issue 37, we look at:
What the recent Shopify app security incidents actually tell us
Why App Store approval and Built for Shopify are not security guarantees
The webhook mistakes that can turn a public endpoint into an attack surface
Why Shopify is moving to expiring offline access tokens
How third-party integrations can quietly expand your security footprint
Why AI-generated code could make these problems more common
Why security may become a competitive advantage for Shopify apps
There is an easy way to think about security:
Don't get hacked.
But for Shopify app founders, that isn't enough anymore.
The more interesting question is:
What happens if your app is compromised?
Because your app may have access to orders, products, customer data, Shopify Admin APIs, webhooks, third-party platforms and much more.
That means the security of your app increasingly affects the security of the merchant.
And this is where we think the ecosystem is heading.
Shopify is tightening the platform.
Token lifetimes are changing.
Data access requirements are becoming stricter.
But the app itself remains another layer that merchants have to trust.
That creates a responsibility that goes beyond passing App Review.
Can merchants trust your app with the access you're asking them to give you?
That's the question we explore in Issue 37.
Read the full issue here:👉 Shopify Apps Have Become the New Security Perimeter
We'd love to know how you're thinking about this.
Are you already doing security reviews of your app and infrastructure?
Or is security something your team mostly addresses when Shopify requires it?
Reply to this email. We read every response.
Till next time,
Best- Yuvraj Kewate
Stop typing what you could say in 10 seconds.
Wispr Flow turns your voice into clean, professional text inside any app. Emails, Slack, client updates — speak once, send without editing. 4x faster than typing.