{
  "id": 14112937,
  "title": "A bot-risk score is not an identity: designing order reviews in Shopify",
  "url": "https://urgent.news/2026/10/13/a-bot-risk-score-is-not-an-identity-designing-order-reviews-in-shopify",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T03:57:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/webdecoy/a-bot-risk-score-is-not-an-identity-designing-order-reviews-in-shopify-4dc4"
  },
  "original_language": "en",
  "account": "Two Shopify app users raised questions about order reviews during a launch discussion. The distinction between observations and conclusions was clarified. Two requests sharing an IP address does not confirm identity or fraud. Multiple IPs used by one actor indicate a legal identity, but VPN or proxy classification does not suggest intent to abuse. Empty detection reports do not guarantee healthy traffic. A decision log and evidence snapshot serve different purposes. The decision log records the reviewer's choice, while the evidence snapshot preserves the detection details at the time of the decision. An optimistic version check prevents concurrent reviews from overwriting each other. Customer and payment details should not be included in notes. WebDecoy's app separates storefront and checkout pixel collection verification. The app does not automatically cancel orders or block checkout. The process involves verifying collection, inspecting order-linked signals, recording reasoning, and then determining the response.",
  "summary": "A suspicious order arrives. Two visits share an IP address, an actor report shows several IPs, and the dashboard assigns a risk score. What should the reviewer actually conclude? I’m Chris, founder of WebDecoy. Two questions on our Shopify launch discussion brought this into focus: what evidence survives a review, and how do you tell missing traffic from missing collection? Here is the…",
  "key_points": [
    "Distinction between observations and conclusions clarified",
    "Multiple IPs by one actor indicates legal identity",
    "Decision log records reviewer's choice, evidence snapshot preserves detection details"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}