OptionWise is a Shopify product options app whose storefront code is deployed to Shopify as a theme app extension and served from Shopify’s CDN, so it cannot be changed from OptionWise’s servers. This page explains how a checkout hijack through an app works, how the ways apps put code on a storefront differ, and how OptionWise is built to keep that risk out.
How a checkout hijack through an app works
In October 2026, shoppers at several Shopify stores clicked Checkout and landed on a fake checkout page on another domain, as Roman Zipp documented in a technical write-up. The page looked like Shopify’s, collected card and address details, then sent the shopper on to the real checkout so nothing seemed wrong. The store’s theme was not edited, and Shopify’s checkout was not breached.
The code came from installed apps. Each affected app had a storefront script that, on every page load, asked the vendor’s servers for the store’s settings. Those settings could include JavaScript, intended as a way for merchants to customize the app. Someone placed malicious JavaScript in those settings. The script ran it, and it took over the Checkout button.
Three conditions made it possible:
- The app’s storefront script fetched settings from the vendor’s servers at page load.
- Those settings could contain code, and the script ran it.
- The settings could be changed without deploying anything to Shopify, by anyone who got access to them.
Each condition is a separate opening. An app built without them gives this attack nowhere to start.
Script tags, app embeds and app blocks
Shopify gives apps three ways to put code on a storefront, and it is retiring the oldest.
Script tags load a script from the app vendor’s own servers on every page. Whatever those servers return is what runs, and it can change at any time without anything being deployed to Shopify. Shopify stopped apps from creating or updating script tags on October 1, 2026, and will stop injecting existing ones into storefronts on March 1, 2027 (Shopify, script tag deprecation).
App embed blocks are part of a theme app extension, Shopify’s replacement for script tags. Their files are deployed to Shopify and served from Shopify’s CDN (content delivery network). An app embed is added to the page’s <head> or the end of its <body>, not to a spot in the layout. It is designed for code and floating elements, such as a chat bubble or a tracking script. The merchant switches it on or off in the theme editor but cannot position it, and it usually loads on every page of the store, including the cart.
App blocks are also part of a theme app extension, but they are designed for components that belong at a specific place in the page, such as a product form or a reviews panel. The merchant adds the block to a section in the theme editor and moves it where they want it, like any other theme block. An app block loads only where it has been placed.
Moving to a theme app extension changes where the first file comes from. It does not change what that file does once it has loaded. The script in the October incident was itself served from Shopify’s CDN; the malicious code arrived afterwards, from the vendor’s servers, disguised as settings. Delivery through Shopify is half of a defensive design. The other half is a script that never fetches anything else to run.
How OptionWise is built
OptionWise fetches nothing from its own servers at page load, has no setting that can hold code, and changes its storefront code only by redeploying its theme app extension to Shopify.
An app block on the product page, built on Shopify’s current platform. OptionWise was built after Shopify shipped theme app extensions, app-owned metafields and Shopify Functions, and it uses them directly. It installs as an app block that the merchant places in the product section, and the block is enabled only on product templates. OptionWise has no app embed and has never used script tags. Its code does not load on the home page, collection pages or the cart page.
Option sets are data, not code. An OptionWise option set holds labels, values, add-on prices, conditional rules and appearance settings. There is no custom code setting. When a merchant saves an option set, OptionWise writes it to app-owned metafields on the store. When a shopper opens a product page, Shopify reads those metafields and renders the options into the page. The configuration reaches the browser as a JSON data block, which browsers never execute. Every label and value is escaped as text, so even a label written to look like code shows up as plain text.
Nothing is fetched from OptionWise at page load. OptionWise’s storefront script reads the configuration already in the page. It does not request settings, scripts or anything else from OptionWise’s servers. The only time it contacts OptionWise is to send a short fault report if it detects a rendering problem; that is a one-way message, and nothing comes back.
The storefront code changes only with a new deployment. OptionWise’s script and stylesheet are files in its theme app extension, served from Shopify’s CDN. Every store runs the same files from the same deployment. Nothing stored on OptionWise’s servers can change them. Changing them means building a new version of the theme app extension and deploying it to Shopify.
OptionWise cannot edit your theme or add script tags. OptionWise asks for permission to read themes, so it can check where its block is placed. It does not ask for permission to write theme files or to add script tags. Control of OptionWise’s servers would not give an attacker a way to put a script on your storefront.
The storefront script never sends shoppers anywhere. OptionWise’s script holds the add-to-cart and express checkout buttons only while a required option is missing, and shows which one. It never changes the page address and never submits forms on the shopper’s behalf.
There is no separate OptionWise login. OptionWise opens inside the Shopify admin and uses the merchant’s Shopify session. There is no OptionWise password for a merchant to reuse or have phished. Two-step authentication on the merchant’s Shopify account protects OptionWise as well.
Add-on prices are applied by Shopify. Prices for add-ons are calculated inside Shopify’s checkout from the stored option sets. They are not calculated by the storefront script, so editing the page cannot change what a shopper is charged.
What a compromise of OptionWise would and would not allow
No vendor is immune to having an account or server compromised, so the useful question is what an attacker could do with it.
Someone with control of OptionWise’s servers could change option sets: rename options, change values, change add-on prices, or change which products they appear on. Those changes would show up in the store’s option sets, where the merchant can see and undo them.
They could not run code in shoppers’ browsers, read what shoppers type into the checkout, redirect the Checkout button, or edit the theme. Those are the things that turn an app incident into stolen card details, and OptionWise’s architecture does not give anyone a way to do them from its servers.
The one route to OptionWise’s storefront code is a new deployment of its theme app extension, which reaches every store at once. Deployments are made from OptionWise’s Shopify Partner account, and every login to that account requires two-step authentication.
Facts at a glance
| Question | OptionWise |
|---|---|
| How is it installed? | An app block in the product section; no app embed, no script tags |
| Where does the storefront script come from? | Its theme app extension, served from Shopify’s CDN |
| Is anything fetched from OptionWise at page load? | No |
| Can settings contain custom JavaScript? | No; option sets are data |
| How are labels and values output? | Escaped as text, in HTML and in the JSON data block |
| How can the storefront code change? | Only by redeploying its theme app extension to Shopify |
| Can OptionWise write theme files or add script tags? | No; it does not have those permissions |
| Does the storefront script navigate or submit forms? | No; it only holds buttons while a required option is missing |
| Separate OptionWise login? | No; it uses the merchant’s Shopify login inside the Shopify admin |
| What happens on the storefront if OptionWise is offline? | Nothing; options render from the store’s own metafields |
Related
- How OptionWise renders product options explains the server-side rendering behind this design, and what it means for page speed, search engines and AI assistants.
Frequently asked questions
Can a Shopify app redirect my customers to a fake checkout?
An app whose storefront script can be changed from the vendor's servers can, if an attacker gets control of that vendor's configuration. In October 2026, shoppers at several Shopify stores were sent to fake checkout pages this way. Apps whose storefront code only changes when a new version of their theme app extension is deployed to Shopify cannot be altered like that from the vendor's dashboard or API.
Are Shopify script tags being switched off?
Yes. Shopify stopped apps from creating or updating script tags on October 1, 2026, and will stop injecting existing script tags into storefronts on March 1, 2027. Apps that load code on the storefront are moving to theme app extensions. OptionWise has never used script tags.
Does OptionWise load code from its own servers on my storefront?
No. OptionWise's storefront script and stylesheet are part of its theme app extension and are served from Shopify's CDN (content delivery network). Option sets are stored as data in app-owned metafields on your store and read by Shopify when the page renders. Nothing is downloaded from OptionWise when a product page loads.
Can OptionWise settings contain custom JavaScript?
No. OptionWise has no custom code setting. An option set is data: labels, values, prices, rules and appearance settings. The storefront treats every piece of it as text, so nothing in an option set can run as code.
What could an attacker do if they got into OptionWise's servers?
Change option sets: labels, values, add-on prices and rules. They could not run code on your storefront, redirect checkout, or edit your theme, because OptionWise's storefront code changes only when its theme app extension is redeployed to Shopify and the app has no permission to write theme files or add script tags.
Do I need a separate password for OptionWise?
No. OptionWise opens inside your Shopify admin and uses your Shopify login, so turning on two-step authentication for your Shopify account protects OptionWise too. There is no separate OptionWise password to phish or reuse.
Try OptionWise on your store
OptionWise adds unlimited product options to any Shopify store. Offer dropdowns, swatches, checkboxes, text fields and file uploads, show or hide options based on other choices, and charge for add-ons at checkout. Install it in a couple of clicks and publish your first option set in minutes.
Add to Shopify