starship / search / business-listing-with-contact-form

Audit report

Business Listing with Contact

Broad accessReach : limited

by TechInfini Solutions · Store design · Shopify App Store

Store design

Risk level

Broad access

Executive summary

Let your customers find your all store locations in no time

Key insights

◆App appears effectively abandoned: last update Oct 2015, no reviews, no BFS badge.
◆Collects customer contact form submissions (PII) but routes through a publisher with weak privacy posture and India-based processing without DPA detail.
◆Publisher domain is a WordPress site on Hostinger behind Cloudflare; no HSTS, minimal CSP, exposes PHP version.
◆No public breaches or CVEs found tied to TechInfini Solutions or this specific app.

Top findingsview all

High
App not updated in over a decade

Synthesis

Analysis summary

Let your customers find your all store locations in no time

Key insights

◆App appears effectively abandoned: last update Oct 2015, no reviews, no BFS badge.
◆Collects customer contact form submissions (PII) but routes through a publisher with weak privacy posture and India-based processing without DPA detail.
◆Publisher domain is a WordPress site on Hostinger behind Cloudflare; no HSTS, minimal CSP, exposes PHP version.
◆No public breaches or CVEs found tied to TechInfini Solutions or this specific app.
◆Primary risk vector is staleness + PII collection: unmaintained code path handling customer data is a latent supply-chain risk.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

App not updated in over a decade

High

Last update date listed as October 27, 2015. A Shopify app that has not been updated in ~10 years almost certainly relies on deprecated APIs, unmaintained dependencies, and lacks modern security hardening. This is a significant supply-chain and abandonment risk.

Evidence

https://apps.shopify.com/business-listing-with-contact-form

Privacy policy lacks specificity on compliance and retention

Medium

Publisher privacy policy mentions no GDPR/SOC2/ISO27001/PCI/HIPAA compliance, no specific sub-processor list, and indefinite retention language ('only for as long as is necessary'). For a contact-form app that collects customer PII (names, emails, inquiries) this is below industry baseline.

Evidence

https://techinfini.in/privacy-policy

Data processed in India with no documented residency guarantees

Medium

Policy states data is processed in India and 'any other places where the parties involved in the processing are located', with no DPA, no SCCs referenced, and no EU/US residency option. EU merchants would face GDPR transfer-risk exposure.

Evidence

https://techinfini.in/privacy-policy

Weak security headers on publisher domain

Low

techinfini.in returns no HSTS header and only a minimal CSP ('upgrade-insecure-requests'). Server discloses PHP 8.3.30 version and runs WordPress. While behind Cloudflare, the lack of HSTS/strong CSP and the WP/PHP fingerprint indicates limited security hygiene.

Evidence

https://techinfini.in/

Zero reviews and no Built for Shopify badge

Info

App has a 0.0 rating with no reviews and lacks the 'Built for Shopify' badge. Limited usage signal; harder to detect issues organically.

Evidence

https://apps.shopify.com/business-listing-with-contact-form

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`unknown`	Info	OAuth scopes are not declared on the public Shopify App Store listing for this app. Cannot be confirmed without install.

unknown

Info

OAuth scopes are not declared on the public Shopify App Store listing for this app. Cannot be confirmed without install.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: techinfini.in
TLS grade: unknown
HSTS: Missing
CSP: Enabled

CSP header present but only sets 'upgrade-insecure-requests' (no source restrictions). No HSTS. Behind Cloudflare with HTTP/2. Server discloses PHP 8.3.30 and WordPress.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy exists but mentions no formal compliance certifications, no specific sub-processors, and uses vague retention language.

Track record

Publisher reputation

Publisher: TechInfini Solutions
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Business Listing with Contact

Key insights

Top findingsview all

Analysis summary

Findings (5)

App not updated in over a decade

Privacy policy lacks specificity on compliance and retention

Data processed in India with no documented residency guarantees

Weak security headers on publisher domain

Zero reviews and no Built for Shopify badge

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage