Audit report
Logify
WatchReach : broadby Tabgraf.com · Customer support · Shopify App Store
Track your shop's activities and admin logs
Key insights
- ◆Read-only logging product requests full write scope across the entire store, scope/function mismatch.
- ◆Privacy policy is gated behind a 403, preventing third-party verification of GDPR claims.
- ◆Very small install base (4 reviews) and no Built for Shopify badge.
- ◆Hosted on Next.js behind Cloudflare; TLS healthy but security headers absent.
Top findingsview all
- HighBroad write access to entire store data
- HighAccess to sensitive customer data including device/activity data
Analysis summary
Track your shop's activities and admin logs
- ◆Read-only logging product requests full write scope across the entire store, scope/function mismatch.
- ◆Privacy policy is gated behind a 403, preventing third-party verification of GDPR claims.
- ◆Very small install base (4 reviews) and no Built for Shopify badge.
- ◆Hosted on Next.js behind Cloudflare; TLS healthy but security headers absent.
- ◆No known CVEs, breaches, or public security incidents tied to Tabgraf or Logify.
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedOAuth scopes requested
These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.
| Scope | Sensitivity | Why we flag it |
|---|---|---|
read_customers | High | Sensitive customer PII including device/activity data; not strictly required to log admin/staff actions. |
read_users | Medium | Staff and contributor data, justifiable for staff action logging. |
write_products | High | Write scope for products is unnecessary for a logging tool. |
write_orders | Critical | Write access to orders is highly sensitive and unjustified for an audit log app. |
write_customers | Critical | Write access to customer records is unnecessary for read-only activity logging. |
write_discounts | High | Unnecessary write scope; financial impact if abused. |
write_gift_cards | Critical | Gift card write access has direct monetary value; unjustified for logging. |
write_marketing_events | Medium | Not needed to read audit data. |
write_payment_terms | High | Payment-related write scope unnecessary. |
write_online_store_pages | Medium | Could be abused for storefront tampering. |
write_analytics | Medium | Unnecessary for a logging product. |
read_customersSensitive customer PII including device/activity data; not strictly required to log admin/staff actions.
read_usersStaff and contributor data, justifiable for staff action logging.
write_productsWrite scope for products is unnecessary for a logging tool.
write_ordersWrite access to orders is highly sensitive and unjustified for an audit log app.
write_customersWrite access to customer records is unnecessary for read-only activity logging.
write_discountsUnnecessary write scope; financial impact if abused.
write_gift_cardsGift card write access has direct monetary value; unjustified for logging.
write_marketing_eventsNot needed to read audit data.
write_payment_termsPayment-related write scope unnecessary.
write_online_store_pagesCould be abused for storefront tampering.
write_analyticsUnnecessary for a logging product.
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedThis section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedNetwork surface
- Primary domain
- tabgraf.com
- TLS grade
- A
- HSTS
- Missing
- CSP
- Missing
Served via Cloudflare with valid TLS; Next.js / OpenNext stack. No Strict-Transport-Security or Content-Security-Policy headers observed on root.
Compliance & certifications
Privacy policy URL exists but returned HTTP 403 to automated fetch, so claims (including publisher's stated GDPR adherence) cannot be independently verified.
Privacy policyPublisher reputation
- Publisher
- Tabgraf.com
- Verified Shopify Partner
- No
- Years active
- 0
- Other apps
- 0