starship / search / algolia-search

Audit report

Algolia Search & Discovery

Broad accessReach : moderateSensitive Access

by Algolia · Store design · Shopify App Store

Store design

Risk level

Broad access

Executive summary

Product search & discovery that increases conversions at scale

Key insights

◆Mature, well-known vendor (Algolia, founded 2012) with SOC2, ISO 27001, and ISO 27017 certifications and a public bug bounty program.
◆Real past incident in 2020 (Salt vulnerability) with public postmortem; no reported customer data exfiltration.
◆Main residual risk is misuse of API keys by merchants in theme/client code, not Algolia's core platform.
◆Strong network surface: HSTS preload, comprehensive CSP, TLS via Cloudflare, X-Content-Type-Options, X-Frame-Options SAMEORIGIN.

Top findingsview all

High
Historic server compromise via Salt vulnerability (CVE-2020-11651)

Synthesis

Analysis summary

Product search & discovery that increases conversions at scale

Key insights

◆Mature, well-known vendor (Algolia, founded 2012) with SOC2, ISO 27001, and ISO 27017 certifications and a public bug bounty program.
◆Real past incident in 2020 (Salt vulnerability) with public postmortem; no reported customer data exfiltration.
◆Main residual risk is misuse of API keys by merchants in theme/client code, not Algolia's core platform.
◆Strong network surface: HSTS preload, comprehensive CSP, TLS via Cloudflare, X-Content-Type-Options, X-Frame-Options SAMEORIGIN.
◆Privacy policy explicitly authorizes use of LLMs and AI tools but does not list providers; chatbot present on site.
◆Modest review score (3.6/5, 45 reviews) and no 'Built for Shopify' badge.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

Historic server compromise via Salt vulnerability (CVE-2020-11651)

High

In May 2020, Algolia infrastructure was compromised via the SaltStack CVE-2020-11651 vulnerability. Attackers installed a cryptocurrency miner and a backdoor on more than 500 servers. Algolia published a retrospective and remediated; no customer data was reportedly exfiltrated, but this is a real past incident.

Evidence

https://www.algolia.com/blog/engineering/salt-incident-may-3rd-2020-retrospective-and-update

Prototype Pollution CVEs in algoliasearch-helper

Medium

CVE-2021-23433 (CVSS 6.8) and CVE-2025-3193 affect the algoliasearch-helper JS library used by InstantSearch. Default InstantSearch configuration is not exploitable, but merchants embedding custom search code on theme could be at risk if outdated versions are bundled.

Evidence

https://github.com/advisories/GHSA-vpf5-82c8-9v36

Industry-wide pattern of leaked Algolia API keys in client apps

Medium

CloudSEK identified ~1,550 third-party apps leaking Algolia API keys, with 32 exposing admin keys (2.5M+ user downloads). Risk is not in Algolia's platform itself but in how developers/merchants embed keys client-side; for Shopify theme integration this is a real misconfiguration risk vector.

Evidence

https://www.securityweek.com/leaked-algolia-api-keys-exposed-data-millions-users/

Broad OAuth scope footprint including theme/web pixel write access

Medium

App accesses customer data, product inventory, order history, device/geolocation/browsing behavior, and is permitted to edit Online Store pages and web pixels. Web pixel + page edit scopes increase blast radius if app or its OAuth token is compromised.

Evidence

https://apps.shopify.com/algolia-search

Privacy policy lacks explicit retention windows and full sub-processor list

Low

Privacy policy states data may be stored in the US and other operating regions with SCCs for EU transfers, but does not enumerate quantitative retention periods or a complete sub-processor inventory inline (directed to a separate Infrastructure & Sub-Processors page).

Evidence

https://www.algolia.com/policies/privacy

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_products`	Low	Required to index catalog for search.
`read_customers`	High	Customer PII pulled into search/personalization context.
`read_orders`	High	Order history used for personalization and recommendations; sensitive purchase data.
`write_online_store_pages`	High	Theme/page write capability is high blast radius if token compromised.
`write_pixels`	High	Web pixel write access enables tracking script injection on storefront.
`read_browsing_behavior`	Medium	Device/geolocation/browsing telemetry feeds personalization.

read_products

Low

Required to index catalog for search.

read_customers

High

Customer PII pulled into search/personalization context.

read_orders

High

Order history used for personalization and recommendations; sensitive purchase data.

write_online_store_pages

High

Theme/page write capability is high blast radius if token compromised.

write_pixels

High

Web pixel write access enables tracking script injection on storefront.

read_browsing_behavior

Medium

Device/geolocation/browsing telemetry feeds personalization.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

*.algolia.net

global (17 regions, 70+ DCs) · Search index hosting and query API

Declared

*.algolia.com

US/EU · Dashboard, analytics, merchandising

Declared

stripe.com

US · Payment processing (Algolia billing)

Declared

intercom.io

US · Customer support chat

Declared

google-analytics.com

US · Web analytics

Declared

Sub-processors

StripeGoogle AnalyticsIntercomGitHubGoogleHeroku

Data residency: unknown

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: algolia.com
TLS grade: A
HSTS: Enabled
CSP: Enabled

HSTS with preload + includeSubDomains; comprehensive CSP enforced (frame-src, script-src, connect-src) and a separate CSP-Report-Only header; X-Content-Type-Options nosniff; X-Frame-Options SAMEORIGIN; served via Cloudflare.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Pass

ISO 27001 Pass

PCI DSS Fail

SOC 2 and ISO 27001/27017 certified; TRUSTe certified; uses SCCs for EU data transfers. HIPAA not supported.

Track record

Publisher reputation

Publisher: Algolia
Verified Shopify Partner: Yes
Years active: 14
Other apps: 0

Past incidents

●2020-05-03 · infrastructure_compromise

LLM exposure

AI / LLM usage

LLM providers

Data shared with providers

Privacy policy authorizes use of LLMs and AI tools on personal information for product features and a website chatbot; specific providers not disclosed.

Retention policy

unknown