A sandboxed checkout extension runs in isolation and cannot read payment details or the checkout page HTML, while an injected script on a page you control can read what the page can read. If your platform offers extensions, they carry less risk than raw scripts on checkout.
What the documentation states
Shopify's checkout UI extensions documentation says extensions add custom UI and logic into steps of the checkout, such as cart review messages or a thank you page survey. It describes how they run in an isolated sandbox, separate from the checkout page and other UI extensions. They do not have access to sensitive payment information or the checkout page itself, whether HTML or other assets. They are limited to specific UI components and APIs exposed by the platform, with limited access to global web APIs. Apps that want protected customer data must apply and pass review. The page also notes that extensions for the information, shipping and payment steps are available only to stores on a particular plan tier, so check availability for your store.
Comparison
| Capability | Sandboxed extension | Script injected into the page |
|---|---|---|
| Reads form fields on the page | No | Yes |
| Reads payment details | No | Yes, if the page exposes them |
| Edits the page freely | No, limited components | Yes |
| Other code on the page can interfere | Isolated | Shares the page |
| Reviewed by the platform for protected data | Yes, per the docs | No |
How to decide
- If the platform offers an extension for the job, use it. A shipping message or survey does not need page access.
- Use an injected script only when no extension can do the job, and then keep it off payment steps.
- Give any script a named owner, a purpose and a removal date.
- Check what data each extension requests, and decline protected customer data you do not need.
- Keep a record of what is installed on checkout and review it before each sales peak. See our peak season dependency freeze plan.
A caution
A sandbox is a design property of the platform, not a guarantee about every vendor. An extension can still show misleading text or send the data it is allowed to see. Review what each one does, even when it is isolated.
Quick check
Can an extension read a card number?
According to the documentation, extensions do not have access to sensitive payment information.
Should I remove all injected scripts from checkout?
Aim to. Each remaining one should have an owner and a reason, and none should run on payment fields.
Sources
Safeguard can help you keep a record of dependencies and changes on storefront code, with a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
