Starship
starship / search / buy-now-direct-checkout

Audit report

AOD Instant Checkout

Broad accessReach : broad

by Apps On Demand · Store design · Shopify App Store

Store design
Risk level
Broad access
Executive summary

Skip the Cart and Send Users Direct to Checkout Page

Key insights

  • ◆App is Built for Shopify certified and has 4.7/5 (39 reviews) since launch in November 2018, established but small footprint.
  • ◆Functionality is narrow: animated 'Buy Now' button that skips cart and routes to checkout. Minimal data surface.
  • ◆Privacy policy is thin and hosted on a separate domain (demandforapps.com) from the publisher site (appsondemandtech.com), with no certifications, residency, or sub-processor disclosure.
  • ◆Publisher infrastructure runs PHP 7.3 (EOL) and uses a personal Gmail for contact, weak operational maturity signals.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Skip the Cart and Send Users Direct to Checkout Page

Key insights
  • ◆App is Built for Shopify certified and has 4.7/5 (39 reviews) since launch in November 2018, established but small footprint.
  • ◆Functionality is narrow: animated 'Buy Now' button that skips cart and routes to checkout. Minimal data surface.
  • ◆Privacy policy is thin and hosted on a separate domain (demandforapps.com) from the publisher site (appsondemandtech.com), with no certifications, residency, or sub-processor disclosure.
  • ◆Publisher infrastructure runs PHP 7.3 (EOL) and uses a personal Gmail for contact, weak operational maturity signals.
  • ◆No CVEs, breaches, or incidents tied to Apps On Demand or this app were found in public sources.
  • ◆OAuth scopes are not publicly listed on the App Store page; auditing scope sensitivity requires install-time inspection.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_products
Low

L'application doit lire les produits pour afficher le bouton Buy Now sur la page produit, induit de la fonction déclarée de l'app.

write_themes
Medium

L'ajout d'un bouton animé sur la page produit nécessite de modifier le thème de la boutique, induit de la fonction déclarée de l'app.

read_themes
Low

L'application doit lire le thème pour y insérer correctement le bouton, induit de la fonction déclarée de l'app.

write_script_tags
Medium

Le comportement de redirection directe vers le Checkout peut requérir l'injection de scripts, induit de la fonction déclarée de l'app.

read_checkouts
Medium

La redirection vers la page de paiement en contournant le panier implique la lecture des données de checkout, induit de la fonction déclarée de l'app.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
appsondemandtech.com
TLS grade
unknown
HSTS
Missing
CSP
Missing

HTTP/2 served; X-Powered-By: PHP/7.3.33 (EOL since Dec 2021); no HSTS or CSP headers observed

Posture

Compliance & certifications

GDPR webhooks Pass
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Basic GDPR data-rights language present; no SOC2/ISO27001/PCI/HIPAA references. Retention period and sub-processors not disclosed.

Privacy policy
Track record

Publisher reputation

Publisher
Apps On Demand
Verified Shopify Partner
Yes
Years active
8
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.