Last night I ran external security scans on the public websites of 10 leading Shopify and Shopify

Plus agencies — the same scan any browser or attacker would see. No credentials, no special access.

One agency scored an A. Three scored C- or below. The most common finding appeared on 9 of 10 sites.

TL;DR

1 agency scored an A. 3 scored C- or below. 1 scored a D.