@ctrlaltdylan

I like building stuff on the internet. Maker of Real ID for Shopify, Woo and BigCommerce - and lots of OSS you've never heard of

 us-east-2
dylanjpierce.com
Joined July 2009
  • Tweets4.6K
  • Following218
  • Followers894
534Media
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
So which frontier lab is going to rewrite PHP internals with Rust as a massive marketing stunt?
1
158
Replying to @John_Speed @martincox100
Prepare for the worst, that's what I always say. One day I'll finish my home bunker office
1
1
45
Replying to @gideon_b
Haha yep. It’s all me. Glad you like Bandit!
13
Replying to @kirplatonov
Good stuff! Makes me wonder if we'll start to see Shopify's sec skill extend to theme linting for unescaped metafields, or potentially just auto-escape under the hood
1
1
183
T minus 1 hour till critical PHP patch release. I wish they disclosed the affected major version(s)
The PHP Foundation@ThePHPFOct 20
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
3
411
The newest guide on how to harden your app against supply chain attacks, with new tooling available in package managers and integrations to help prevent breaches: verybadpanda.dev/field-guide…

Supply chain attacks: guard the loading dock · Very Bad Panda

You didn't write most of the code you ship, and neither did your agent. How supply chain attacks work, why AI coding makes them worse, and how to layer Socket.dev and pnpm so a poisoned package never...

verybadpanda.dev
4
342
Here's a Shopify App Security Field Guide so we can keep up with this changing landscape: verybadpanda.dev/field-guide… I've been publishing new guides and tactics based on what's happening in the ecosystem. Clearly the times have changed, and it's an opportunity to improve

Field Guide · Very Bad Panda

Reference and best-practice how-tos for building secure Shopify apps — authorization, OAuth, HMAC, secrets, and more.

verybadpanda.dev
3
6
3
33
4,077
Shopify is taking app security seriously too. Breaches hurt the whole system, not just the individual apps with poor sec policies. How can you trust installing apps if you're seeing others? Shopify's app security skill is a solid start but there's more you can do: community.shopify.dev/t/secu…

Securing your app, together

Merchants install your app because they trust it, and because they trust the Shopify App Store. There are bad actors out there who are motivated to exploit that trust. Alongside the rest of the...

community.shopify.dev
2
3
32
2,483
Replying to @celispj
I'm not seeing an option to apply to the Defense Tier specifically. The form isn't showing an option for "self defense, non-enterprise" type tier. But you can still use Opus, open weight models, etc to test against your app in CI/CD: verybadpanda.dev/field-guide…

Security reviews in CI: an AI pentester on every PR · Very Bad Panda

How to wire Strix (or any AI harness) into GitHub Actions without letting it own your repo. Run it before merging, and on a regular interval.

verybadpanda.dev
2
872
Replying to @ShopifyDevs @atleeclark @eytanseidman
I'll be there!
4
221
Finally able to build something that merchants have been asking over and over for years now. So so excited. Can't share details now but so grateful for the opportunity
7
148
Replying to @Brian_Peotter
Ohio leads the nation in being stuck in Ohio
2
12
1,602
Replying to @ShopifyDevs
This is great! Already integrated. Here's an example of automating these scans in your CI/CD: verybadpanda.dev/field-guide…

Shopify's app security check, on every PR · Very Bad Panda

Shopify now ships a security scanner in the CLI. Wire it into GitHub Actions so it blocks risky merges on its own, and hand its judgment calls to an agent before you release.

verybadpanda.dev
1
2
235
Merchant trust is everything Which means security is everything Introducing `app security check` A tool that finds common vulnerability patterns in Shopify apps Run it with AI Toolkit
31
35
28
274
35,886
Confirmed. This fire pit slaps
50
Replying to @JordanFinners
Haha I’ve been setting a version constant manually for telemetry for awhile now. This is nice
1
1
55
Real runners don’t post to strava
8
229
Now it's limited to unit tests only, it doesn't actually mock the UI. But at least you can test business logic and error edges, which is at least giving you a base line foundation to work from.
86
I can't believe I missed this. Now you can write automated tests for your Shopify UI Extensions - including POS 🤯 pnpm i --dev @shopify/ui-extensions-tester
1
5
318
Not rocket science but proud of this new intro page design I launched today. 1. (Hopefully) clear instructions 2. Visual and primary action above the fold 3. Dismissible by power users
6
416
Load more