
How River takes security work from a fix to merge (2026) - Shopify
River, Shopify’s AI agent in Slack, enables autonomous vulnerability remediation, not just detection.
305 articles from Shopify Engineering.

River, Shopify’s AI agent in Slack, enables autonomous vulnerability remediation, not just detection.

Gisting compresses context into a set of learned tokens, preserving its quality while making the model faster and cheaper.

We rebuilt our mobile end-to-end testing framework with a strict API and computer vision, raising test stability drastically.

How we compress production failures into model weights every day, beat frontier-model quality, and cut serving costs 96%.

We built an agentic code review and test oracle harness that discovers vulnerabilities, proves them with real tests, and provides Shopify-tuned fixes.

We moved five high-traffic checkout extensions to remote-dom and Polaris web components, cutting bundle sizes drastically and making checkout faster.

Hack Days are a core part of Shopify’s experimentation culture. Here’s one project that made product pages sing.

How Shopify built an LLM-powered pipeline to match product listings across millions of merchants into a unified catalog that AI agents can search.

Our Sidekick team used LLM judges to automatically curate training data and teach domain-specific models how to refuse impossible queries.

Quick lets anyone at Shopify ship a site in seconds. It has changed the culture of how we build and share.

What it took to ship our Slack-native agent River, lessons learned, and the substrate that runs beneath it. Co-authored by River.

How we used SKIP LOCKED, composite primary keys, and connection visibility to hit our scale targets.

We fine-tuned Qwen3-32B into a tool-calling agent that generates Flow automations: 2.2x faster, 68% cheaper, with a weekly retraining flywheel.

How we cut our CI pipeline build time by 65% and open-sourced the project.

How we built a configurable in-store AI experience that any merchant can adapt to their brand.

We questioned why conventional GraphQL execution incurs hidden costs, and rewrote it in a faster breadth-first manner to avoid them.

No traffic? No problem. SimGym sends hundreds of AI shoppers through your store to simulate A/B tests. A Shopify and NVIDIA collaboration.

From raw event sequences to real-time predictions: what it took to build and ship a generative recommender at commerce scale.

GPUs are annoying. Shopify uses SkyPilot to make them less so: one YAML file, multiple clouds, clean development ergonomics.

Under the hood of UCP: the open protocol powering agentic commerce, enabling AI agents to discover, negotiate, and transact with any merchant.

Tangle saves months of compute time, makes every experiment automatically reproducible, and allows teammates to share computation without coordination.

Our interactive, real-time visualization of sales made by Shopify-powered merchants worldwide—built into a pinball game.

We combined FTMS sensors, Socket.IO, and POS UI extensions to turn a manual treadmill into a discount-printing machine.

Nine months of chaos engineering and scale tests so intense we ran them (mostly) at night. Inside our 2025 readiness program for Black Friday weekend.

Learn how we solved a major search engineering dilemma—running machine learning models at native C++ speed.

Our prior work used Vision Language Models for automatic product classification. This post delves into how AI agents are evolving the taxonomy itself.

Shopify successfully migrated two of its largest apps, Shopify Mobile and Shopify Point of Sale (POS) to React Native's New Architecture while maintaining weekly releases and serving millions of merchants. This migration involved a complex codebase with hundreds of screens and native modules, extensive custom components, and deep integration with first-party libraries like FlashList.

Learn how we evolved our AI assistant architecture and built robust evaluation frameworks for real-world deployment

MCP UI extends the Model Context Protocol to enable AI agents to return fully interactive UI components. It solves the critical challenge that commerce experiences require visual and interactive elements like product selectors, image galleries, and cart flows. This open-source protocol allows agents to embed commerce components while maintaining control through an intent-based messaging system, de

FlashList v2 is a complete rewrite, delivering faster load times, improved scrolling performance, and precise rendering without requiring item size estimates. It powers thousands of lists in the Shopify mobile app and is now production-ready.

Shopify’s Global Catalogue demonstrates the impact of multimodal LLMs on one of commerce’s hardest problems: building a unified, structured, and continuously evolving understanding of billions of product listings created by millions of merchants. At the International Conference on Learning Representations (ICLR) 2025 Expo in Singapore, we presented the core engineering behind this initiative

Discover how Shopify uses machine learning, data, and advanced tools to help merchants succeed in the ever-changing game of commerce.

Learn how we just made Shopify's Admin 30% faster while setting it up for AI superpowers. Behind the scenes, we completely transformed how admin.shopify.com works—rebuilding a system that powers 67 million daily page views and merchants live inside to run their business.

In the last three years, React Native Skia has established itself as the go-to solution for 2D graphics on React Native. And we are seeing many users pushing the boundaries of what can be done with the library.

Roast is a convention-oriented workflow orchestration framework designed specifically for creating structured AI workflows that interleave AI prompting with normal non-AI execution. It provides a declarative approach primarily using YAML configuration and markdown prompts, giving AI agents the guardrails they need to solve developer productivity problems at scale.

Learn how we partnered with Coinbase to bring payments onchain at scale with a new smart contract protocol to meet the complex requirements of commerce.

Import maps are great for both performance and developer experience, but their original limitations made them hard to use, especially at Shopify’s scale. We stepped up and pushed changes across the HTML spec, Chromium and WebKit to fix these issues at the web platform level. Now, developers can interleave JavaScript modules and multiple import maps on their HTML pages without worrying about correc

Shopify’s product classification system has evolved from basic categorization to an AI-driven framework using Vision Language Models and the Shopify Product Taxonomy. It accurately classifies products, extracts attributes, and processes over 30 million predictions daily, improving search, discovery, trust, and efficiency.

We built a framework that transforms WebViews in the Shopify app to feel native and solve performance and integration challenges without rebuilding for mobile.

Five years ago, we announced that React Native (RN) is the future of mobile at Shopify. Today, we are excited to share the progress we've made, lessons learned, and what the future holds. To recap, we decided to switch to RN for 3 main reasons: Write it once - Stop building the same features twice, once on iOS and once on Android Talent portability - Enable devs to work fluently across iOS, Androi

Every year for Black Friday Cyber Monday (BFCM), we put together a real-time visualization of purchases made through Shopify-powered merchants worldwide. This year we're cooking up something big, and in anticipation we wanted to show you how we built the globe last year. Video of BFCM 2023 Globe Besides going for better visuals, a big focus was performance. We've put together an interactive deep d

In the dynamic landscape of commerce, Shopify merchants rely on our platform's ability to seamlessly and reliably deliver highly relevant products to potential customers. Therefore, a rich and intuitive search experience is an essential part of our offering. Over the past year, Shopify has been integrating AI-powered search capabilities into our merchants’ storefronts. Shopify Storefront Search ha

Insight into how Shopify created a seamless one-click manual testing experience (known as "tophatting") for mobile applications by creating a macOS app.

The problem In order to guarantee data integrity, MySQL requires locks prior to updating existing records. If multiple processes update data in the same table in parallel, deadlocks can occur depending on how the data is stored in disk and managed by MySQL. That can happen even if the different processes target different records. This blog post explores the problem of deadlocks in MySQL while upda

How we shipped ES module integrity in browsers and made commerce and the web better for everyone!

As an integral part of Shopify's ecosystem, our mobile app serves millions of merchants around the world every single day. It allows them to run their business from anywhere and offers vital insights about store performance, analytics, orders, and more. Given its high-engagement nature, users frequently return to it, underscoring the importance of speed and efficiency. At the beginning of 2023, we

This article was originally posted on the Rails at Scale blog. In September, 2020, our team at Shopify released a Ruby gem named Packwerk, a tool to enforce boundaries and modularize Rails applications. Since its release, Packwerk has taken on a life of its own, inspiring blog posts, conference talks, and even an entire gem ecosystem. Its popularity is an indication that Packwerk clearly filled a

Shop app horizontally scaled a Ruby on Rails app with Vitess. This blog describes Vitess and our detailed approach for introducing Vitess to a Rails app.

Skia is a cross-platform 2D graphics library that provides a set of drawing primitives which run on iOS, Android, macOS, Windows, Linux, and the browser. Over the past two years, Shopify Engineering has sponsored development of the @shopify/react-native-skia library that exposes Skia functionality to React Native. The React Native (RN) Skia community is one of the most vibrant and interesting in t

We’ve recently open sourced a project called Ruvy! Ruvy is a toolchain that takes Ruby code as input and creates a WebAssembly module that will execute that Ruby code. There are other options for creating Wasm modules from Ruby code. The most common one is ruby.wasm. Ruvy is built on top of ruby.wasm to provide some specific benefits. We created Ruvy to take advantage of performance improvements f

In October 2022, Shopify released ShopifyQL Notebooks, a first-party app that lets merchants analyze their shop data to make better decisions. It puts the power of ShopifyQL into merchants’ hands with a guided code editing experience. In order to provide a first-class editing experience, we turned to CodeMirror, a code editor framework built for the web. Out of the box, CodeMirror didn’t have supp

In this post, learn how Shopify's Sidekick solves markdown rendering jank and response delay in LLM chatbots with buffering parser and async content resolution.

Remix is now the recommended way to build Admin apps on Shopify. With Remix, you get a best-in-class developer experience while ensuring exceptional out-of-the-box performance for your app. Remix embraces the web platform and web standards, allowing web developers to use more of their existing knowledge and skills.

Jeff Charles, a Senior Shopify Developer, shares key learnings from his successful pull request to Winch. The pull request aimed to add support for various WebAssembly instructions to Wasmtime's baseline (non-optimizing) compiler.

In this article, Ebun covers how we added flexibility to our previous one-size-fits-all order routing system with the introduction of “routing rules”, and how we dogfooded our own Shopify Functions feature to give merchants the ability to create their own routing rules.

At the beginning of this year, we ran several experiments aimed at reducing the latency impact of the Ruby garbage collector (GC) in Shopify's monolith. In this article, Jean talks about the changes we made to improve GC performance, and more importantly, how we got to these changes.

A look at Shopify’s experience improving state management in the Shopify POS app by migrating from a Vanilla Redux codebase to Redux Toolkit one.

A staff developer is an individual contributor who can have the same scope of impact and seniority as an engineering manager.

Passkeys are a new login credential based on public-key cryptography that replace the need for username and password sign-ins.

Here are a few internationalization (i18n) best practices to help front-end developers avoid errors and serve more robust text content on multilingual websites and apps.