Security

No secrets in themes

Everything in a theme is public: Liquid output, assets, settings_data.json. Never put API keys, access tokens, passwords or private endpoints in a theme. Integrations that need secrets belong in an app, using the Admin API.

Output escaping

Sooquna escapes all output, so data from shoppers (names, reviews, search terms) can’t inject scripts. Don’t work around it: build markup in the template and print values into it.

In JavaScript, pass data with the json filter, which is safe inside <script>:

<script type="application/json" id="ProductJSON">{{ product | json }}</script>

and read it with JSON.parse(document.getElementById("ProductJSON").textContent). Never build JavaScript strings by printing values between quotes.

Links from merchants

url settings refuse javascript: and other unsafe links. Rich text is cleaned of scripts and event handlers when saved.

Third-party scripts

Every script you add runs with full access to the shopper’s page, including the cart and the account pages’ links. Load only what you need, from providers you trust, with defer. Analytics and ad pixels belong in the merchant’s pixel settings, where they load only after consent, not in the theme.

SVG

Uploaded SVG assets are cleaned of scripts, and served with a policy that blocks scripts inside them.