starship / search / calculated-prices

Audit report

Calculated Prices by Holest

WatchReach : broad

by Holest Engineering · Sales and conversion optimization · Shopify App Store

Sales and conversion optimization

Risk level

Watch

Executive summary

Product conditional price parameters, text inputs and uploads

Key insights

◆Publisher Holest Engineering has a documented history of vulnerabilities in sibling products (multiple 2025 CVEs in WooCommerce plugins, including a critical CVSS 9.8), raising SDLC concerns.
◆App is hosted/processed in Germany, favorable EU data residency for EU merchants.
◆Privacy policy claims customer data is processed only transiently in RAM and not persisted, reducing breach blast radius if accurate.
◆Shop metadata retention is indefinite-by-default, which conflicts with GDPR right-to-erasure expectations.

Top findingsview all

High
Publisher has multiple CVEs in sibling products

Synthesis

Analysis summary

Product conditional price parameters, text inputs and uploads

Key insights

◆Publisher Holest Engineering has a documented history of vulnerabilities in sibling products (multiple 2025 CVEs in WooCommerce plugins, including a critical CVSS 9.8), raising SDLC concerns.
◆App is hosted/processed in Germany, favorable EU data residency for EU merchants.
◆Privacy policy claims customer data is processed only transiently in RAM and not persisted, reducing breach blast radius if accurate.
◆Shop metadata retention is indefinite-by-default, which conflicts with GDPR right-to-erasure expectations.
◆No 'Built for Shopify' badge, 0 reviews, low Shopify-side trust signal.
◆Publisher domain holest.com lacks basic web hardening (no HSTS, no CSP, older nginx 1.18.0).

Detections

Findings (7)

Risks detected through static, network, and policy analysis.

Publisher has multiple CVEs in sibling products

High

Holest Engineering's WooCommerce plugins have multiple recent CVEs including CVE-2025-60243 (CVSS 9.8 Critical, Selling Commander privilege escalation), CVE-2025-48129 (privilege escalation), CVE-2025-48124 (path traversal), and an SQL injection issue in Spreadsheet Price Changer. While these affect WooCommerce code, they indicate weak SDLC/security review practices by the publisher that may apply to the Shopify app as well.

Evidence

https://nvd.nist.gov/vuln/detail/CVE-2025-48129

No HSTS header on publisher domain

Medium

Publisher domain holest.com responds over HTTPS but does not set Strict-Transport-Security. This permits downgrade attacks on first request and is a common security baseline failure.

Evidence

https://holest.com/

No Content-Security-Policy header on publisher domain

Medium

Publisher domain returns no CSP, exposing visitors to XSS reflection risks. Combined with the absence of HSTS and outdated nginx 1.18.0, suggests minimal hardening effort.

Evidence

https://holest.com/

Indefinite shop data retention by default

Medium

Privacy policy states shop metadata (email, name, install info) is retained indefinitely after uninstall unless the merchant explicitly requests deletion. This is incompatible with GDPR default-erasure expectations for EU merchants.

Evidence

https://holest.com/holest-outsourcing/terms-and-conditions/128-calculated%E2%80%91prices-privacy-policy.html

Third-party trackers integrated (Google Analytics, Facebook Pixel)

Low

Privacy policy discloses use of Google Analytics and Facebook Pixel on Holest properties. Not directly app data flow, but indicates broad data sharing with US-based ad/analytics platforms without listed DPA/SCC controls.

Evidence

https://holest.com/holest-outsourcing/terms-and-conditions/128-calculated%E2%80%91prices-privacy-policy.html

No compliance certifications disclosed

Low

Privacy policy does not reference GDPR DPA, SOC2, ISO27001, PCI DSS, or HIPAA. No data processing agreement is offered to merchants.

Evidence

https://holest.com/holest-outsourcing/terms-and-conditions/128-calculated%E2%80%91prices-privacy-policy.html

App requests write_orders / draft_orders scope

Info

App declares 'Edit orders (draft orders)' scope. This is consistent with custom-pricing functionality but represents an elevated capability that should be reviewed against actual usage.

Evidence

https://apps.shopify.com/calculated-prices

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Access to customer name, email, phone, address, geolocation, PII with notification obligations under GDPR/CCPA.
`read_users`	Medium	Staff data including store owner information.
`write_products`	Medium	Edit products, inventory, collections, needed for pricing logic but can be abused to alter catalog.
`write_draft_orders`	High	Edit draft orders, financial side effects; necessary for cart-side custom pricing.
`write_online_store_pages`	Medium	Edit Online Store content, can inject scripts or modify storefront.
`write_price_rules`	Medium	Edit price rules, core to pricing functionality, abuse could distort merchandising.

read_customers

High

Access to customer name, email, phone, address, geolocation, PII with notification obligations under GDPR/CCPA.

read_users

Medium

Staff data including store owner information.

write_products

Medium

Edit products, inventory, collections, needed for pricing logic but can be abused to alter catalog.

write_draft_orders

High

Edit draft orders, financial side effects; necessary for cart-side custom pricing.

write_online_store_pages

Medium

Edit Online Store content, can inject scripts or modify storefront.

write_price_rules

Medium

Edit price rules, core to pricing functionality, abuse could distort merchandising.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: holest.com
TLS grade: unknown
HSTS: Missing
CSP: Missing

nginx/1.18.0 (Ubuntu), HTTPS works but no HSTS, no CSP, P3P present (legacy/deprecated header). Cache-Control no-store on root.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy exists but discloses no formal compliance certifications. EU-based hosting may give de facto GDPR alignment but no DPA referenced.

Track record

Publisher reputation

Publisher: Holest Engineering
Verified Shopify Partner: No
Years active: 8
Other apps: 0

Past incidents

●CVE-2025-60243 (CVSS 9.8 Critical) Selling Commander for WooCommerce, privilege escalation
●CVE-2025-48129 Spreadsheet Price Changer for WooCommerce, privilege escalation
●CVE-2025-48124 Spreadsheet Price Changer for WooCommerce, path traversal
●SQL injection in Spreadsheet Price Changer for WooCommerce

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Calculated Prices by Holest

Key insights

Top findingsview all

Analysis summary

Findings (7)

Publisher has multiple CVEs in sibling products

No HSTS header on publisher domain

No Content-Security-Policy header on publisher domain

Indefinite shop data retention by default

Third-party trackers integrated (Google Analytics, Facebook Pixel)

No compliance certifications disclosed

App requests write_orders / draft_orders scope

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage