Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Contact us
Contact
Back to Glossary

Shopify Flow (Run Code)

ShopifyDesign & Development Methods

Definition

The "Run Code" action inside Shopify Flow — Shopify's built-in no-code workflow engine — which lets you write JavaScript directly within a workflow.

Background

Flow is often assumed to handle only simple no-code automation — tagging, emails — but Run Code supports advanced logic such as JSON handling and LIFO algorithms. This makes it possible to build enterprise-grade business logic entirely within Shopify, with no custom backend.

Flagship's Involvement

In February 2026, one of our engineers published the column "Beyond Drag-and-Drop: Programming Complex Logic in Shopify Flow" on flagship.inc, presenting real implementations built entirely with Flow + Run Code, including annual rollover of member benefits and LIFO consumption logic.

Back to Glossary Top