starship / search / also-bought

Audit report

Also Bought • Recommendations

Broad accessReach : moderateSensitive Access

by Code Black Belt · Sales and conversion optimization · Shopify App Store

Sales and conversion optimization

Risk level

Broad access

Executive summary

Amazon-like 'Customers Who Bought This Also Bought' cross-sell

Key insights

◆Built for Shopify certified app from Code Black Belt, 4.8/5 rating (357 reviews) - strong merchant trust signal
◆Read-only scope profile (products, orders, themes, customer activity) with no write_* permissions declared
◆Privacy policy asserts no third-party data sharing and 30-day deletion after uninstall - positive
◆Publisher site is on Shopify infrastructure (Cloudflare + HSTS + CSP block-all-mixed-content + frame-ancestors none) - healthy network surface

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Amazon-like 'Customers Who Bought This Also Bought' cross-sell

Key insights

◆Built for Shopify certified app from Code Black Belt, 4.8/5 rating (357 reviews) - strong merchant trust signal
◆Read-only scope profile (products, orders, themes, customer activity) with no write_* permissions declared
◆Privacy policy asserts no third-party data sharing and 30-day deletion after uninstall - positive
◆Publisher site is on Shopify infrastructure (Cloudflare + HSTS + CSP block-all-mixed-content + frame-ancestors none) - healthy network surface
◆No public CVEs, breaches, or incidents found tied to Code Black Belt or Also Bought
◆Compliance gap: policy denies GDPR/CCPA applicability despite collecting IP/geolocation/contact data

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Privacy policy claims GDPR/CCPA non-applicability despite collecting PII

Medium

The privacy policy asserts that the app is not affected by GDPR or CCPA because 'it does not process or use personal data'. However the listing's declared access (customer device/activity data including geolocation, IP address, browser info, plus store owner contact information) suggests PII is in fact processed. This is a legal/compliance posture concern even if technical handling is adequate.

Evidence

https://docs.codeblackbelt.com/article/2056-privacy-policy

No published compliance certifications (SOC2, ISO27001)

Low

Privacy policy does not mention SOC2, ISO27001, PCI DSS, or HIPAA certification. For an app processing customer behavior data across many stores, lack of public assurance is a moderate trust signal.

Evidence

https://docs.codeblackbelt.com/article/2056-privacy-policy

Data residency not disclosed

Low

Privacy policy does not specify where data is stored or processed geographically. This complicates regional compliance assessments for EU merchants.

Evidence

https://docs.codeblackbelt.com/article/2056-privacy-policy

Access to full order history

Info

App declares access to complete order history to power recommendations. Scope is justified by use case but represents a sensitive data surface; relies entirely on publisher controls since no third-party sub-processors are declared.

Evidence

https://apps.shopify.com/also-bought

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_products`	Low	Required to surface product recommendations
`read_orders`	High	Full order history is sensitive; needed to compute co-purchase signals
`read_themes`	Medium	Required to inject the recommendation widget into theme
`read_online_store_pages`	Low	Storefront context for widget placement
`read_customers`	High	Implied by customer activity/contact data access in listing
`read_locales`	Info	Supports multi-language widget rendering
`read_markets`	Info	Supports multi-market storefronts

read_products

Low

Required to surface product recommendations

read_orders

High

Full order history is sensitive; needed to compute co-purchase signals

read_themes

Medium

Required to inject the recommendation widget into theme

read_online_store_pages

Low

Storefront context for widget placement

read_customers

High

Implied by customer activity/contact data access in listing

read_locales

Info

Supports multi-language widget rendering

read_markets

Info

Supports multi-market storefronts

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: codeblackbelt.com
TLS grade: A
HSTS: Enabled
CSP: Enabled

HSTS max-age=7889238, CSP with block-all-mixed-content + frame-ancestors 'none' + upgrade-insecure-requests, X-Frame-Options DENY, X-Content-Type-Options nosniff; site hosted on Shopify/Cloudflare

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy claims non-applicability to GDPR/CCPA; no SOC2/ISO27001/PCI/HIPAA mentioned. States 30-day deletion after uninstall and no proactive third-party sharing.

Track record

Publisher reputation

Publisher: Code Black Belt
Verified Shopify Partner: Yes
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Also Bought • Recommendations

Key insights

Top findings

Analysis summary

Findings (4)

Privacy policy claims GDPR/CCPA non-applicability despite collecting PII

No published compliance certifications (SOC2, ISO27001)

Data residency not disclosed

Access to full order history

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage