starship / search / amazonify

Audit report

Zonify

Broad accessReach : broad

by importify · Finding and adding products · Shopify App Store

Finding and adding products

Risk level

Broad access

Executive summary

Amazon Dropshipping

Key insights

◆Long-tenured app (launched Oct 2016) with small review base (~15 reviews) but high rating (4.9).
◆Publisher 'importify limited' operates a sibling WooCommerce product that had a public CVE in 2023 (CVE-2023-49194, low severity).
◆Privacy policy is behind a bot-challenge wall - reduces verifiability of GDPR/compliance claims.
◆Publisher origin returns no security headers (no HSTS/CSP) on basic probe.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Amazon Dropshipping

Key insights

◆Long-tenured app (launched Oct 2016) with small review base (~15 reviews) but high rating (4.9).
◆Publisher 'importify limited' operates a sibling WooCommerce product that had a public CVE in 2023 (CVE-2023-49194, low severity).
◆Privacy policy is behind a bot-challenge wall - reduces verifiability of GDPR/compliance claims.
◆Publisher origin returns no security headers (no HSTS/CSP) on basic probe.
◆App advertises AI features (product optimization, multi-language translation) without disclosing LLM providers, data flow, or retention.
◆No 'Built for Shopify' badge observed. No public security incident tied to Zonify specifically.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

Privacy policy page returns bot-protection interstitial

Medium

The privacy policy URL (zonify.app/privacy-policy) returns a verification/challenge page to automated requests, preventing programmatic review of data handling claims. Human-accessible content could not be automatically verified.

Evidence

https://zonify.app/privacy-policy/

Publisher origin returns HTTP 415 with no security headers

Medium

Root domain zonify.app responded HTTP/2 415 with only server/date/content-type headers - no HSTS, no CSP, no X-Content-Type-Options, no Referrer-Policy. While 415 may be a method-rejection artifact, the absence of any baseline security headers indicates weak transport hardening posture at the edge.

Evidence

https://zonify.app/

Publisher has prior CVE in sibling product (WooCommerce plugin)

Low

CVE-2023-49194 (CVSS 5.3, Sensitive Data Exposure / Broken Access Control) was disclosed against the Importify WooCommerce plugin <=1.0.4 (sibling product by same publisher). No CVE found against the Shopify app, but it indicates the publisher has shipped exploitable access-control bugs in production.

Evidence

https://nvd.nist.gov/vuln/detail/CVE-2023-49194

OAuth scopes not surfaced on listing page

Low

The Shopify App Store listing did not enumerate required scopes in fetched content. Dropshipping apps of this class typically require write_products and read_orders. Scope sensitivity cannot be fully assessed without install-time disclosure.

Evidence

https://apps.shopify.com/amazonify

AI/LLM usage advertised without disclosure on data sharing

Info

App is marketed as 'Amazon AI Dropshipping' with AI-powered product optimization and 20+ language translation, implying LLM/translation API usage. No public disclosure of which AI providers are used, what data is sent, or retention policy. Merchant-facing transparency is incomplete.

Evidence

https://apps.shopify.com/amazonify

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`write_products`	High	Required to import Amazon products into Shopify catalog - core advertised function. Allows creation/modification of product data.
`read_products`	Medium	Likely needed to manage already-imported listings and pricing rules.
`write_themes`	High	Possible but not confirmed - affiliate link injection may need theme/script access.

write_products

High

Required to import Amazon products into Shopify catalog - core advertised function. Allows creation/modification of product data.

read_products

Medium

Likely needed to manage already-imported listings and pricing rules.

write_themes

High

Possible but not confirmed - affiliate link injection may need theme/script access.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: zonify.app
TLS grade: unknown
HSTS: Missing
CSP: Missing

Root probe returned HTTP/2 415 with only server/date/content-type. No HSTS, CSP, X-Content-Type-Options, or Referrer-Policy headers observed.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy URL exists but returns bot-protection interstitial to automated fetchers - could not verify GDPR/SOC2/ISO27001/PCI/HIPAA claims or retention policy.

Track record

Publisher reputation

Publisher: importify
Verified Shopify Partner: No
Years active: 10
Other apps: 0

Past incidents

●CVE-2023-49194 - Sensitive Data Exposure in Importify WooCommerce plugin <=1.0.4 (CVSS 5.3, fixed in 1.0.5)

LLM exposure

AI / LLM usage

LLM providers

Data shared with providers

Product titles/descriptions sent for AI-powered optimization and 20+ language translation. Specific providers not disclosed.

Retention policy

unknown

Zonify

Key insights

Top findings

Analysis summary

Findings (5)

Privacy policy page returns bot-protection interstitial

Publisher origin returns HTTP 415 with no security headers

Publisher has prior CVE in sibling product (WooCommerce plugin)

OAuth scopes not surfaced on listing page

AI/LLM usage advertised without disclosure on data sharing

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage