From 7ec671ed560eda93e07a6fde86be6e18bdb572b8 Mon Sep 17 00:00:00 2001 From: Josh Larson Date: Sun, 4 Oct 2026 21:58:53 -0500 Subject: [PATCH] Align MISSING_EMBEDDED_CSP catalog severity with its check --- .../app/src/cli/services/app-security-engine/rules/catalog.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/app/src/cli/services/app-security-engine/rules/catalog.ts b/packages/app/src/cli/services/app-security-engine/rules/catalog.ts index 3a076d55c3c..f996d3f37a1 100644 --- a/packages/app/src/cli/services/app-security-engine/rules/catalog.ts +++ b/packages/app/src/cli/services/app-security-engine/rules/catalog.ts @@ -108,7 +108,7 @@ export const RULE_CATALOG: RuleCatalogEntry[] = [ { id: 'MISSING_EMBEDDED_CSP', title: 'Embedded app missing frame-ancestors CSP directive', - severity: 'high', + severity: 'medium', points: -10, description: 'Detects embedded apps that set document response headers but omit frame-ancestors.', fix: 'Add frame-ancestors to CSP, restricted to the authenticated shop domain and admin.shopify.com.',