starship / search / adscale

Audit report

AdScale

WatchReach : broad

by AdScale · Marketing · Shopify App Store

Marketing

Risk level

Watch

Executive summary

Increase sales & revenue with smart, automated advertising

Key insights

◆AdScale is an established AI-powered ad-optimization app for Facebook/Instagram/Google (4.6 rating, 370 reviews).
◆Scope set is broad (PII + behavioral + scripts/pixels) but consistent with audience-building and ad-attribution use case.
◆No public CVE, breach, or security incident found tied to AdScale or its publisher.
◆Not 'Built for Shopify' badged.

Top findingsview all

High
Broad access to sensitive customer PII and behavioral data

Synthesis

Analysis summary

Increase sales & revenue with smart, automated advertising

Key insights

◆AdScale is an established AI-powered ad-optimization app for Facebook/Instagram/Google (4.6 rating, 370 reviews).
◆Scope set is broad (PII + behavioral + scripts/pixels) but consistent with audience-building and ad-attribution use case.
◆No public CVE, breach, or security incident found tied to AdScale or its publisher.
◆Not 'Built for Shopify' badged.
◆Publisher website and privacy policy sit behind Cloudflare and reject programmatic fetches (HTTP 403), limiting external transparency.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Broad access to sensitive customer PII and behavioral data

High

App requests sensitive customer data (name, email, phone, address) plus device/activity data (geolocation, IP, browser, browsing behavior, client ID), staff PII, customers, products, orders, store analytics, web pixels, scripts, and inventory. This breadth is justifiable for an ad-optimization platform but materially expands the impact of any compromise.

Evidence

https://apps.shopify.com/adscale

Publisher website behind Cloudflare bot challenge; HSTS/CSP not observable

Medium

Direct HEAD to https://www.adscale.com returns Cloudflare 403 (bot challenge). HSTS and Content-Security-Policy response headers are not present in the observable response. TLS is properly served via Cloudflare (HTTP/2). HSTS/CSP may still be applied to genuine browser sessions but cannot be confirmed externally.

Evidence

https://www.adscale.com/

Online Store scripts + web pixels access raises storefront tampering risk

Medium

App can install Online Store scripts and web pixels, which execute in the buyer-facing storefront context. A compromise of the publisher could be used to inject malicious JS (skimming, redirects) into merchant storefronts. Mitigated by Shopify's pixel sandbox but still elevates blast radius.

Evidence

https://apps.shopify.com/adscale

Privacy policy not externally accessible to bot fetchers

Info

Privacy policy URL returns 403 to automated retrieval (Cloudflare). Could not programmatically verify residency, sub-processors, retention, or stated certifications.

Evidence

https://www.adscale.com/privacy-policy/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Customer PII (name, email, phone, address) used for audience building and ad attribution.
`read_orders`	High	Order data used to compute ROAS, LTV, and conversion attribution.
`read_products`	Medium	Product catalog feeds dynamic ad creatives.
`read_inventory`	Medium	Avoid promoting out-of-stock SKUs.
`read_analytics`	Medium	Store performance metrics for optimization.
`write_script_tags`	High	Online Store scripts execute in storefront context; tampering risk.
`write_pixels`	High	Web pixels run in sandboxed buyer context for conversion tracking.
`read_content`	Low	Collections / store content for catalog ads.

read_customers

High

Customer PII (name, email, phone, address) used for audience building and ad attribution.

read_orders

High

Order data used to compute ROAS, LTV, and conversion attribution.

read_products

Medium

Product catalog feeds dynamic ad creatives.

read_inventory

Medium

Avoid promoting out-of-stock SKUs.

read_analytics

Medium

Store performance metrics for optimization.

write_script_tags

High

Online Store scripts execute in storefront context; tampering risk.

write_pixels

High

Web pixels run in sandboxed buyer context for conversion tracking.

read_content

Low

Collections / store content for catalog ads.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: adscale.com
TLS grade: A
HSTS: Missing
CSP: Missing

HTTPS served via Cloudflare (HTTP/2). HSTS and CSP headers not present in observable response; origin returns 403 to bot fetchers so client-targeted policies could not be verified.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy exists at the documented URL but returns Cloudflare 403 to automated retrieval; specific certifications could not be confirmed.

Track record

Publisher reputation

Publisher: AdScale
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

AdScale

Key insights

Top findingsview all

Analysis summary

Findings (4)

Broad access to sensitive customer PII and behavioral data

Publisher website behind Cloudflare bot challenge; HSTS/CSP not observable

Online Store scripts + web pixels access raises storefront tampering risk

Privacy policy not externally accessible to bot fetchers

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage