Shopify: admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed

Summary: A staff user removed from a Shopify store continues to receive customer Personally Identifiable Information PII via a previously created automation workflow. The workflow, configured using Shopify Flow, continues executing after the user's access has been revoked and sends sensitive...

Malicious code in shopify_flow_app (npm)

The package shopifyflowapp was found to contain malicious code...

MAL-2025-33145 Malicious code in shopify_flow_app (npm)

The package shopifyflowapp was found to contain malicious code...

Shopify: H1514 Removed Staff members who had "Apps" permission can still modify flow app connections

Summary: It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description: Flow app https://apps.shopify.com/flow allows users to connect their Google Sheets, Trello and Asana accounts to their flow...