Starship
starship / search / alidropship

Audit report

Aliexpress Dropshipping

WatchReach : limited

by appfreaker · Finding and adding products · Shopify App Store

Finding and adding products
Risk level
Watch
Executive summary

Import Products from Aliexpress and Synchronize inventory

Key insights

  • ◆Dropshipping app launched 2017 by publisher 'appfreaker' / tuecus.com with modest reputation (4.2 stars, 32 reviews on listing).
  • ◆Privacy policy is bare-bones, no sub-processors named, no retention, no certifications, no data residency.
  • ◆Publisher web infrastructure runs end-of-life PHP 7.3 and lacks CSP, raising supply-chain risk.
  • ◆No publicly reported breaches or CVEs tied to publisher or app.

Top findingsview all

  • High
    Privacy policy lacks required disclosures
Synthesis

Analysis summary

Import Products from Aliexpress and Synchronize inventory

Key insights
  • ◆Dropshipping app launched 2017 by publisher 'appfreaker' / tuecus.com with modest reputation (4.2 stars, 32 reviews on listing).
  • ◆Privacy policy is bare-bones, no sub-processors named, no retention, no certifications, no data residency.
  • ◆Publisher web infrastructure runs end-of-life PHP 7.3 and lacks CSP, raising supply-chain risk.
  • ◆No publicly reported breaches or CVEs tied to publisher or app.
  • ◆App imports product data from AliExpress and operates a Chrome extension companion, broad surface but no indication of LLM/AI usage.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

unknown
Medium

Scopes not publicly declared on Shopify App Store listing; typical dropshipping app requires read/write products, orders, customers.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
tuecus.com
TLS grade
unknown
HSTS
Enabled
CSP
Missing

HSTS max-age=31536000 present; X-XSS-Protection and X-Content-Type-Options set; CSP missing; X-Powered-By discloses end-of-life PHP 7.3.33; server header discloses nginx 1.26.1; only HTTP/1.1 negotiated.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy policy exists but lacks GDPR-mandated disclosures (sub-processors, retention, residency, DPA terms). No certifications claimed.

Privacy policy
Track record

Publisher reputation

Publisher
appfreaker
Verified Shopify Partner
No
Years active
9
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.