Starship
starship / search / address-labels

Audit report

Address Labels

Broad accessReach : moderateSensitive Access

by Hi5 Development, LLC · Orders and shipping · Shopify App Store

Orders and shipping
Risk level
Broad access
Executive summary

Print labels for your orders directly in your admin panel.

Key insights

  • ◆App is a small-scale label-printing utility published by Hi5 Development, LLC
  • ◆Hosted on Heroku (US region); HTTPS with HSTS enabled (max-age=63072000, includeSubDomains)
  • ◆Privacy policy is minimal: confirms US hosting and user-controlled deletion but names no sub-processors and lists no certifications
  • ◆OAuth scopes not explicitly listed on App Store page; functionality (reading orders to print labels) implies read_orders is needed

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Print labels for your orders directly in your admin panel.

Key insights
  • ◆App is a small-scale label-printing utility published by Hi5 Development, LLC
  • ◆Hosted on Heroku (US region); HTTPS with HSTS enabled (max-age=63072000, includeSubDomains)
  • ◆Privacy policy is minimal: confirms US hosting and user-controlled deletion but names no sub-processors and lists no certifications
  • ◆OAuth scopes not explicitly listed on App Store page; functionality (reading orders to print labels) implies read_orders is needed
  • ◆No known security breaches or CVEs found for Hi5 Development, LLC or the Address Labels app
  • ◆App rating is low (2.2/5, 13 reviews) - product quality concerns rather than security concerns
  • ◆Not 'Built for Shopify' certified

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_orders
High

Required to read order data (customer name, shipping address) for label printing. Inferred from app functionality; not explicitly declared on listing page.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
address-labels.herokuapp.com
TLS grade
A
HSTS
Enabled
CSP
Missing

HSTS enabled with 2-year max-age and includeSubDomains. CSP header is present but empty, providing no enforced policy. X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin are set.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy policy exists but does not assert any certification. US data residency confirmed.

Privacy policy
Track record

Publisher reputation

Publisher
Hi5 Development, LLC
Verified Shopify Partner
No
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.