# Script Editor preview token still working with uninstalled application, even for unpublished script

Shopify Script Editor preview tokens never expire and survive app uninstall, letting a former collaborator leave hidden discount scripts running on the storefront.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-08-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/915940
- Library page: https://bugbountylibrary.com/r/h1%3A915940
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:business-logic

**Target:** Script Editor admin preview endpoint and storefront cart preview token
**Root cause:** The preview_script_id token generated at /admin/scripts/preview has no expiry and is not invalidated when the Script Editor app is uninstalled, so an unpublished script keeps executing on the storefront.
**Steps:**
1. Create a script in Script Editor and click preview to obtain `https://{shop}.myshopify.com/admin/scripts/preview?script_id={script_id}` which redirects to `/cart?preview_script_id={preview_script_id}`
2. Note the preview_script_id token and confirm it still applies discounts after uninstalling the Script Editor app
3. Optionally PATCH `https://script-editor.shopifycloud.com/scripts/{id}` with `name` set to a zero-width space to hide the script name in the order timeline
4. Proceed to checkout with the preview token to observe the discount applied
**How found:** Observed that the preview redirect issues a preview_script_id token, then tested token behavior after uninstalling the app and found it still valid; separately noticed the order timeline hyperlink depends on the script name and tried an empty/zero-width name.
**Exploitation:** A developer/collaborator with prior admin access creates an unpublished discount script, captures the preview token, and uninstalls the app; the token continues to apply discounts to carts, and the zero-width script name removes the timeline deep-link so the admin cannot easily find or edit the script.
**Escalation:** Hiding the script name via zero-width character suppresses the order timeline hyperlink, making the rogue script harder to discover and edit.
**Insight:** Preview/draft tokens for storefront-affecting features are often scoped to the app install lifecycle rather than the token itself — test whether preview tokens expire or are revoked on app uninstall, and whether display fields (script name) can be blanked to break admin audit trails.