Orb44 — Shopify example: password page, public catalog

A password on the storefront is not the whole picture. Not a named merchant. Not a pentest.

What was open

products.json and collections.json returned the full catalog with prices despite the password gate. An App Proxy path answered to more than GET, a hint of a write surface on the merchant backend.

What changed

The merchant restricted the public JSON endpoints and reviewed which methods the App Proxy backend should accept.