Docs
Vigil
These notes describe the app we are building. Nothing here is installable yet.
What a scan looks at
- The published theme, including app embeds, app blocks, and JavaScript assets.
- The live storefront, for a script or frame that is not in a theme file. A password page is not the storefront.
- External scripts and frames, with the theme file or app that added each one.
- Strings that look like leaked keys or tokens.
- Store events Vigil can already see, kept past the 250 Shopify shows in admin.
What you can do with a finding
A person can turn a bad script off, and undo that. The same host can be turned off on every store under one account. When the published theme changes, Vigil records it. Vigil does not uninstall other apps.
Agent scan
The scan is also an MCP tool. Claude, ChatGPT, or Cursor can ask Vigil to scan a store and receive the same findings: script, source, and the reason it was flagged. The merchant still approves any change.
What version 1 does not read
Customer records and order contents stay out of version 1. That keeps the first review off protected customer data.
Two addresses
appnary.com is the public site: this page, the product page, and the waitlist. The Shopify admin screen is hosted on the control panel. That host runs the install, the scan, webhooks, and the agent tool. Merchants open Vigil from Shopify admin. They do not install it from this site.
Waitlist
The waitlist stays open while we build Vigil and while Shopify reviews it. After the listing is approved, we invite people from the list. There is no public install URL before that.