Security

Plan: every plan, including Free. Security is the same on every plan.

A wishlist app runs on every page of your store, so Cove is built to give an attacker as little to work with as possible. You can check each point below against what Shopify shows you when you install the app.

Read-only access

Cove holds these permissions on your store and no others. Its only write permission is write_app_proxy, which can’t change products, customers, orders or code.

Permission	Why
`read_orders`	Count wishlist sales for your revenue report: which order lines came from a wishlist, and their amounts. Only order, line and product IDs and amounts are kept, never names, emails or addresses.
`read_products`	Show saved products and spot price drops and restocks.
`read_customers`	Tie wishlists to signed-in customers by their Shopify ID, and match imported lists to customers.
`unauthenticated_read_product_listings`	Show product details on the My wishlist account page.
`write_app_proxy`	Route your store’s /apps/wishlist address to the app. Can’t change store data or code.

Cove never asks for write_themes, write_script_tags, write_online_store_pages, write_products, write_customers, write_orders or read_all_orders. Without the first three it can’t edit your theme, add scripts or change your pages. read_orders covers only the last 60 days of orders. An automated test blocks any release that changes the permission list.

You can see the same list in the app under Settings › Account › Security and data.

No remote code

The code that runs on your storefront ships only inside Cove’s theme app extension, which Shopify versions on every release. Changing what runs on your store therefore needs a new, recorded app version.
Cove’s servers never send scripts or HTML to the browser. The storefront API returns data only, and the code that shows it sets text, never markup. The wishlist pages served at /apps/wishlist are Liquid that Shopify renders.
No custom JavaScript, on any plan. Custom CSS (Pro) is rebuilt rule by rule and only styles Cove’s own elements; anything that could load a file or reach outside Cove is dropped. An uploaded custom icon is stored as shapes, never as markup.

Design is rendered by Liquid

Your design and settings are saved in a metafield the app owns, and Shopify’s Liquid turns them into your storefront’s markup and styles. The storefront script never fetches design or settings from Cove’s servers, so a setting is data Shopify renders, not code that runs in the browser.

Nothing left in your theme

Cove never writes to your theme: everything it adds comes from its app embed and app blocks, which you place in the theme editor. Uninstalling the app removes them with it, so no Cove code stays behind in your theme files.

If something goes wrong: the kill switch

Cove can switch off all of its storefront features on one store, or on every store, at once. The switch is a setting the app embed and blocks read through Liquid, so pausing ships no code either. While it’s on, Cove adds nothing to your pages and its storefront requests answer “unavailable”; nothing is deleted, and everything comes back when it’s switched off. It’s an emergency measure we use if a storefront feature ever misbehaves; you don’t need to do anything.

How it is run

Encryption in transit (HTTPS) and at rest. Data is stored in the EU (Amsterdam, Netherlands).
Hardware-key two-factor authentication on every account that can reach production; production and test data kept apart; access to production data is logged.
Every wishlist change is logged with internal IDs only (no customer IDs, emails or product IDs), and an unusual volume of changes on a store raises an alert.
Pages the app serves send standard security headers: HTTPS-only (HSTS), no content-type guessing, a strict referrer policy and no camera, microphone or location access. The app’s public pages can’t be framed by other sites; the admin pages can only be framed by your own Shopify admin.
Dependencies are pinned and their registry signatures verified, and Shopify’s app security check runs on every change.

Incident response

If we find or are told about a security incident, we contain it first (pause the affected feature or access, revoke and rotate credentials), tell affected merchants without undue delay and within 72 hours of confirming it, fix the cause, check every affected store, and publish a written postmortem.

Report a vulnerability

Email contact@stackcraftdigital.co.uk with what you found, how to reproduce it and the store or URL involved (a development store, please, not a live one). We reply within two business days, keep you updated until it’s fixed, and won’t take action against good-faith research that avoids harming merchants, shoppers, their data or the service.

The same contact is published in covewishlist.com/.well-known/security.txt, and the full statement is on covewishlist.com/security.

Privacy and GDPR: what is stored and for how long.