starship / search / address-validator

Audit report

Address Validator

TrustedReach : moderateSensitive Access

by RoboTurk · Store design · Shopify App Store

Store design

Risk level

Trusted

Executive summary

Address verification to crush failed deliveries and delays!

Key insights

◆Built for Shopify badge present; 4.7 rating across 191 reviews indicates an established listing.
◆Publisher RoboTurk operates under the Clearer.io / AppHub umbrella (privacy policy host).
◆Hosting declared in United States and Ireland; data accessed from ~17 additional countries per policy.
◆No LLM/AI usage disclosed in the privacy policy.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Address verification to crush failed deliveries and delays!

Key insights

◆Built for Shopify badge present; 4.7 rating across 191 reviews indicates an established listing.
◆Publisher RoboTurk operates under the Clearer.io / AppHub umbrella (privacy policy host).
◆Hosting declared in United States and Ireland; data accessed from ~17 additional countries per policy.
◆No LLM/AI usage disclosed in the privacy policy.
◆No compliance certifications (SOC2, ISO27001, GDPR/CCPA attestation) explicitly claimed.
◆No CVE, breach, or security incident found in public sources tied to RoboTurk or this app.
◆Publisher marketing site lacks HSTS and CSP and leaks server stack via X-Powered-By.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

No HSTS header on publisher domain

Low

The publisher's primary domain (addressvalidator.com) responds with HTTPS but does not return a Strict-Transport-Security header, leaving first-visit traffic vulnerable to TLS-stripping.

Evidence

https://addressvalidator.com/

No Content-Security-Policy header on publisher domain

Low

Publisher's site exposes server fingerprint (Apache/2.4.62 Debian, PHP/8.3.21) via X-Powered-By header and ships no CSP, increasing XSS surface for the marketing site.

Evidence

https://addressvalidator.com/

Privacy policy points to unrelated parent entity (Clearer.io / AppHub) with broad cross-app sub-processor sprawl

Low

The privacy policy redirects from apphub.com to clearer.io and lists ~19 sub-processors (Google Analytics/Ads, Meta Pixel, FullStory, Hotjar, Lucky Orange, Yandex Metrica, Segment, Sentry, Intercom, etc.) shared across the publisher's portfolio. No app-specific data flow is disclosed for Address Validator.

Evidence

https://www.clearer.io/privacy-policy

No public OAuth scope disclosure on App Store listing

Info

The 'this app needs access to' block was not surfaced on the public listing at fetch time; scope sensitivity could not be independently verified.

Evidence

https://apps.shopify.com/address-validator

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	Medium	Address validation typically requires reading order/shipping addresses to flag undeliverable destinations.
`read_customers`	High	Customer address data is PII; required to validate shipping destinations at checkout.
`write_checkouts`	High	Blocking PO boxes / military addresses at checkout implies modifying checkout flow or showing validation messaging.

read_orders

Medium

Address validation typically requires reading order/shipping addresses to flag undeliverable destinations.

read_customers

High

Customer address data is PII; required to validate shipping destinations at checkout.

write_checkouts

High

Blocking PO boxes / military addresses at checkout implies modifying checkout flow or showing validation messaging.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

addressvalidator.com

unknown · App backend / marketing site

Declared

clearer.io

US/EU · Parent company (AppHub/Clearer.io) infrastructure and privacy program

Declared

Sub-processors

Google (Analytics, Adwords, Tag Manager)Meta (Ads, Pixel)CloudflareStripeIntercomFullStoryYandex MetricaLinkedInRedditBing AdsHotjarDatadogLucky OrangeSegmentSentryNew RelicMailChimpAmplitudeOribi

Data residency: US

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: addressvalidator.com
TLS grade: A
HSTS: Missing
CSP: Missing

HTTPS reachable with Apache 2.4.62 / PHP 8.3.21. No HSTS, no CSP, and X-Powered-By leaks server stack.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy hosted by parent Clearer.io / AppHub. No explicit certifications claimed; references general data-retention principle without firm timeline for this app.

Track record

Publisher reputation

Publisher: RoboTurk
Verified Shopify Partner: Yes
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.