Nexus Verify · For Shopify app sellers
Your Shopify app, independently scanned — before a review asks the hard questions
If you sell a Shopify app, a security question you cannot answer can mean a failed review, a flag, or a takedown. This is the Security Check aimed at that moment: your app’s code run through the calibrated scanner, then every finding read in its own context and dispositioned one by one — so you know what is real, what is not, and what to fix first, before anyone else asks.
What’s checked
- The sample behind this service: before selling a single scan, we ran the calibrated scanner over two public codebases — 230 files, 28,900 lines, 16 findings. 1 was a real defect, 1 a watch item, and 14 were cleared, each with its reason printed. Nothing buried.
- The instrument, measured: on the OWASP Benchmark the same instrument scores Youden’s J 0.4100 with precision 0.7169 — good, not perfect, which is why every finding is read in context — not just machine-flagged; nothing reaches your report unread — and the report says so on its face.
What you get
- A plain-English report covering every finding, each read in context and dispositioned — real, watch, or cleared, with the reason printed.
- A fix-first order, so the issues most likely to draw a reviewer’s attention are dealt with first.
- Evidence you can show: an independent report, with its scope stated on its face, that you can act on and refer back to at review time.
- And if it finds problems? We can fix them — and prove the fix. See Fix & Verify.
Process
How it works
One named contact, not a ticket queue. No account, no portal, no obligation until the scope, the price, and the delivery date are in writing and you have said yes.
One named contact replies
One named contact, start to finish — the same contact at verify@novitasnexus.com scopes your job, updates you mid-job, and walks you through the result. No ticket queue, no handoffs.
A few questions, in plain English
We ask the two or three questions that actually scope the job, then confirm our understanding back to you before quoting.
Scope and date in writing
Before any money moves: exactly what will be checked, what the report contains, the price, and the delivery date — in writing.
An update while it runs
You hear from us mid-job, proactively. You never have to ask where things stand.
The report, delivered with a full walkthrough
A plain-English walk of the findings first, with the full report and its signed receipt attached. A short walkthrough is offered, too.
One re-check, included
Fix the findings, and we re-check the fixed items once — included in the fee, so you know the fixes hold.
We check in after delivery
A few days after delivery, we check in — to see how the fixes landed and whether anything needs another look. You are not left alone with the report.
- Honest limits: a scan is not a penetration test and not a certification, and it never promises a review outcome — what it gives you is the findings, read properly, while there is time to fix them.
Honest terms
What is never for sale
Start with the intake
Tell us what you need checked. The quote comes back in writing, and a payment link is sent with your confirmed quote — you pay only after you have seen the final price in writing and accepted it.
Go to the intake form →A different question? See the full menu →