# Securing Shopify Storefront Chatbots & Preventing Coupon Exploits

> Stop fake 100%-off promo code requests, unauthorized refund commands, $0 cart overrides, and catalog scraping on Shopify storefronts.

## Storefront AI Issues We Block

E-commerce chat assistants often connect to discount tools, order lookup APIs, and product catalogs. Bad actors sometimes try to trick storefront chatbots into giving out unauthorized discounts or refunds:

- **Fake Discount & Promo Code Requests:** Blocks messages trying to enter "admin mode" or call `generate_coupon` for 100%-off codes, while allowing normal shoppers to ask *"Do you have any welcome discounts?"*
- **Unauthorized Refund Commands:** Stops messages claiming a manager approved an immediate full refund without a return.
- **$0.00 Cart & Price Tampering:** Blocks attempts to rewrite `unit_price` or checkout totals.
- **Template & Catalog Scraping:** Blocks `{{ shop.permanent_domain }}` or `` strings and requests to dump your full product catalog as JSON.

### Shopify App Proxy Endpoint

Gated supports Shopify App Proxy HMAC-SHA256 verification at `POST /shopify/proxy/check` and returns a signed `gate_token` when a shopper message is approved.