shopify-debug-bundle

The script is primarily a legitimate Shopify diagnostic collector and contains no clear malware, persistence, destructive behavior, or covert exfiltration. Its main security concern is that SHOPIFY_STORE controls the destination while the access token is sent in request headers, allowing credential disclosure if that variable is attacker-controlled or tampered with. Validate the store against an expected Shopify domain, restrict API version input, and use comprehensive secret redaction before sharing bundles.