We found a vulnerability which exploits the Import Attendee feature to send spam and phishing emails in bulk. Though we do have measures in place to automatically detect and shut down these actions, those measures do not work consistently during the first two weeks following installation.

Besides being a headache for the people getting these emails, this type of exploitation opens us up to liabilities and could lead to Evey being removed from Shopify and shut down completely. It could also potentially open our merchants up to liabilities in certain rare scenarios, though we've confirmed that none of these scenarios have occurred to this point.

To stop this from happening, we decided to disable the Import Attendee feature for the first 14 days of any plan, including both trials and paid subscriptions. This will allow us to rebuild this feature safely from the ground up so that no one can use it for harmful purposes and Evey remains safe for all merchants and attendees.

If you’re on a trial plan or just signed up for a paid plan, you won’t be able to use the Import Attendee feature during the first 14 days following your last installation of Evey. After this period, the feature will be available for you to use.

We recognize this is inconvenient, and we apologize for the frustration. We appreciate your patience while we work on this issue, and we look forward to rolling out a new and improved version in the near future!