Starship
starship / search / aliexpress-review-importer

Audit report

AliExpress Review Importer

TrustedReach : moderate

by Judge.me · Store design · Shopify App Store

Store design
Risk level
Trusted
Executive summary

Export reviews from Ali Express for your dropship products

Key insights

  • ◆Free app published by Judge.me, the established Shopify review platform (Israel-based, SOC2 Type 2 certified per public compliance page).
  • ◆Built for Shopify badge present and 4.9/5 rating (177 reviews).
  • ◆Last update reported as March 2018, stale codebase, but publisher (Judge.me) is actively maintained on their main platform.
  • ◆Publisher runs a HackerOne bug bounty (mature security posture).

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Export reviews from Ali Express for your dropship products

Key insights
  • ◆Free app published by Judge.me, the established Shopify review platform (Israel-based, SOC2 Type 2 certified per public compliance page).
  • ◆Built for Shopify badge present and 4.9/5 rating (177 reviews).
  • ◆Last update reported as March 2018, stale codebase, but publisher (Judge.me) is actively maintained on their main platform.
  • ◆Publisher runs a HackerOne bug bounty (mature security posture).
  • ◆Data flow: imports public AliExpress reviews into the merchant's Shopify store and optionally into Judge.me's platform; primary destination is judge.me (US/AWS hosted).
  • ◆No known CVEs or breaches attributable to Judge.me; CVE results refer to unrelated 'Judge0' product.
  • ◆Privacy policy lists named sub-processors including Shopify, Stripe, Google Analytics, HotJar, Facebook Pixel, AdRoll.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_products
Low

Required to identify products to attach imported reviews to (scope not explicitly published on listing, inferred from function).

write_products
Medium

Likely required to attach review metadata / product metafields; inferred from app behavior. Not explicitly published.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
judge.me
TLS grade
A
HSTS
Enabled
CSP
Missing

judge.me serves via CloudFront with HSTS (max-age=31536000; includeSubDomains) and x-content-type-options: nosniff. No CSP header observed on root document. Site is served from Framer hosting.

Posture

Compliance & certifications

GDPR webhooks Pass
SOC 2 Type II Pass
ISO 27001 Fail
PCI DSS Pass

Judge.me publishes a compliance page citing SOC 2 Type 2, GDPR, CCPA, and PCI-DSS adherence. Data Processing Addendum available for EEA subjects. ICO (UK) listed as regulator.

Privacy policy
Track record

Publisher reputation

Publisher
Judge.me
Verified Shopify Partner
Yes
Years active
12
Other apps
1
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.