Key takeaways
- A theme pull request that removes a section, block type, setting id or alternate template can drop content merchants placed on the live store, and the diff won't show it.
- Auditor reads the store's published theme for exactly what the pull request removes, and comments with what would be lost, such as "12 products use product.bundle".
- The check never writes to the store, calls no model and costs nothing.
- Findings resolve on their own once the pull request keeps the item or the store stops using it.
In a Shopify theme, the code lives in git but much of the content doesn't. Merchants place sections on templates, set block options and assign products to alternate templates in the theme editor and the admin, and all of that is stored on the store, keyed by ids defined in the theme's code.
So a tidy-looking pull request can do real damage. Rename a setting id and every value merchants set for it is gone. Remove a block type and the blocks of that type disappear from every page. Delete an alternate template and the products assigned to it quietly fall back to the default one. Code review can't catch this, because the content isn't in the repository.
What the check reads
When a pull request removes or renames something a store's content can depend on, Auditor reads the store's published theme for that thing and reports what merchants would lose:
| The pull request | What Auditor reads on the store |
|---|---|
| Removes or renames a section, or a theme block | Every template and section group that places it |
| Removes a block type from a section's schema | Blocks of that type inside that section |
| Removes or renames a setting id | Placements that set it, with their values (one left at its default isn't reported) |
| Removes a section's last preset | Where the section is already placed |
| Removes or renames an alternate template | Products, collections, pages, blogs and articles assigned to it |
| Adds Liquid that reads a metafield | The store's metafield definitions |
What a finding looks like
Findings sit on the line where the removed setting or block was, so the author sees them in context:
12 products use product.bundle; removing it falls them back to product. Keep the template, or assign them another one in the store's admin before this ships.
Others read like "8 placements on the store set show_vendor; removing it loses those values", followed by the values merchants chose, or "Section X has no presets left; merchants can no longer add it from the theme editor". Content findings are High, while a removed last preset or a missing metafield definition is Low.
The check run also notes what was compared, for example "Checked 3 removed ids and metafields against merchant content on your-store: 1 finding."
How it stays safe and cheap
- It reads only what the pull request removes, through the Shopify Admin API, and never writes. A pull request that removes nothing reads nothing.
- It compares the whole pull request, base to head, on every review, and resolves its own earlier finding once the pull request keeps the item or the store stops using it.
- No model is called, so the check costs nothing.
- If the store can't be reached, the check is skipped with a note and never fails the review.
Turning it on
The check runs on Shopify theme repositories (those with layout/theme.liquid and config/settings_schema.json) that have a store chosen for theme previews. Auditor reaches the store through your team's Shopify sign-in or the repository's Theme Access password; checking metafield definitions needs the sign-in.
It's on by default. To turn it off, clear Check merchant content in reviews in the repository's settings.
The same review also checks translation keys and Theme Store readiness. If you work with an AI agent, the Auditor MCP server's content_usage and template_assignments tools answer the same questions before you open a pull request.
Frequently asked questions
Does Auditor change anything on my store?
No. The check only reads the published theme for what the pull request removes. It never writes to the store.
Does the merchant content check cost anything?
No. It calls no model, so nothing is billed for it. The rest of the review is billed as inference as usual.
What if the store is password protected or unreachable?
An unreachable store is skipped with a note on the review, and the review itself never fails because of it.