starship / search / ac-advanced

Audit report

AC Advanced

WatchReach : broad

by AIM Shopify Apps · Marketing · Shopify App Store

First-partyMarketing

Risk level

Watch

Executive summary

Connects your store with Active Campaign effortlessly

Key insights

◆App connects Shopify stores to ActiveCampaign (email marketing), typically requires read_customers, read_orders, write_customers.
◆Publisher 'AIM Shopify Apps' / 'AIM Apps' operating under apexsuite.com brand.
◆Privacy policy is on plain HTTP, no TLS, significant trust signal failure.
◆Single 1-star review and reports of unsolicited installations and double-charging.

Top findingsview all

High
Privacy policy served over plain HTTP (no TLS)
High
Reports of unauthorized app installation and recurring charges

Synthesis

Analysis summary

Connects your store with Active Campaign effortlessly

Key insights

◆App connects Shopify stores to ActiveCampaign (email marketing), typically requires read_customers, read_orders, write_customers.
◆Publisher 'AIM Shopify Apps' / 'AIM Apps' operating under apexsuite.com brand.
◆Privacy policy is on plain HTTP, no TLS, significant trust signal failure.
◆Single 1-star review and reports of unsolicited installations and double-charging.
◆No 'Built for Shopify' badge, no compliance certifications mentioned, no AI/LLM usage disclosed.
◆No public CVEs or confirmed breaches tied to AIM/apexsuite, but reputation and hygiene are weak.

Detections

Findings (6)

Risks detected through static, network, and policy analysis.

Privacy policy served over plain HTTP (no TLS)

High

Publisher's privacy policy URL is http://apps.apexsuite.com/privacy-policy (HTTP, not HTTPS). Linking a privacy policy over an unencrypted channel is a basic hygiene failure for an app that touches customer data.

Evidence

http://apps.apexsuite.com/privacy-policy

Reports of unauthorized app installation and recurring charges

High

Public report and merchant review indicate the AC Advanced app appeared in stores without intentional installation and attempted multiple charges with no refund offered. Suggests questionable distribution practices.

Evidence

https://apps.shopify.com/ac-advanced

Privacy policy lacks data residency, retention, and named sub-processors

Medium

Policy does not specify hosting region, data retention period, named sub-processors, or compliance certifications (GDPR/SOC2/ISO27001/PCI). Generic language about 'trusted third parties' and 'gateway providers' without naming them.

Evidence

http://apps.apexsuite.com/privacy-policy

Missing security headers (HSTS, CSP) on publisher domain

Medium

HEAD request to https://apps.apexsuite.com/ returned no Strict-Transport-Security header and no Content-Security-Policy header, weakening defense against downgrade attacks and XSS.

Evidence

https://apps.apexsuite.com/

Very poor merchant reputation (1.0 star, 1 review)

Medium

App carries a 1.0-star rating with only a single review. Combined with lack of 'Built for Shopify' badge and unverified publisher status, suggests low maturity and minimal merchant trust.

Evidence

https://apps.shopify.com/ac-advanced

OAuth scopes not visible on App Store listing

Low

Declared OAuth scopes are not visible on the public listing; cannot confirm least-privilege design without an install flow inspection.

Evidence

https://apps.shopify.com/ac-advanced

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Implied by ActiveCampaign sync use case; not verified on listing
`write_customers`	High	Implied for bidirectional contact sync; not verified on listing
`read_orders`	High	Likely needed for order-based email automations; not verified on listing

read_customers

High

Implied by ActiveCampaign sync use case; not verified on listing

write_customers

High

Implied for bidirectional contact sync; not verified on listing

read_orders

High

Likely needed for order-based email automations; not verified on listing

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: apps.apexsuite.com
TLS grade: A
HSTS: Missing
CSP: Missing

HTTPS reachable but neither HSTS nor CSP headers present; privacy policy link itself uses plain HTTP.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy exists but is generic; no certifications referenced; breach notification commitment of 7 business days only.

Track record

Publisher reputation

Publisher: AIM Shopify Apps
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

AC Advanced

Key insights

Top findingsview all

Analysis summary

Findings (6)

Privacy policy served over plain HTTP (no TLS)

Reports of unauthorized app installation and recurring charges

Privacy policy lacks data residency, retention, and named sub-processors

Missing security headers (HSTS, CSP) on publisher domain

Very poor merchant reputation (1.0 star, 1 review)

OAuth scopes not visible on App Store listing

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage