Stored XSS on demo app link

How it was found

Hi,

I found stored XSS in apps.shopify.com in the DEMO URL of the apps you create.

#POC

1. go to your partner account and create a new app
2. go to DEMO link in https://apps.shopify.com/services/app_submissions/edit# of your app

put the payload you see below:

{F374863}

and when pressing on preview changes button and then pressing on view example store xss will fire as follows:

{F374865}

thanks!

Impact

Stored XSS on apps.shopify.com