Starship
starship / search / cart-activity

Audit report

Cart Activity

Broad accessReach : broadSensitive Access

by Devels Advocates LLP · Sales and conversion optimization · Shopify App Store

Sales and conversion optimization
Risk level
Broad access
Executive summary

see everything

Key insights

  • ◆Cart Activity is a real-time cart-behavior analytics app by Devels Advocates LLP, $8.99/mo with 21-day trial.
  • ◆App carries the Built for Shopify badge and a 4.1/5 rating across ~10 reviews.
  • ◆Backend is hosted on AWS (CloudFront + API Gateway), TLS terminated by AWS, likely strong baseline TLS.
  • ◆OAuth scopes are not publicly declared on the listing, likely read_orders / read_checkouts / read_products for cart-event monitoring, but unconfirmable.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

see everything

Key insights
  • ◆Cart Activity is a real-time cart-behavior analytics app by Devels Advocates LLP, $8.99/mo with 21-day trial.
  • ◆App carries the Built for Shopify badge and a 4.1/5 rating across ~10 reviews.
  • ◆Backend is hosted on AWS (CloudFront + API Gateway), TLS terminated by AWS, likely strong baseline TLS.
  • ◆OAuth scopes are not publicly declared on the listing, likely read_orders / read_checkouts / read_products for cart-event monitoring, but unconfirmable.
  • ◆Privacy policy page returned no substantive content during fetch, compliance posture (GDPR/SOC2/data residency) is undocumented publicly.
  • ◆No CVEs, breaches, or public security incidents found for the publisher or product.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_products
Low

L'app doit lire le catalogue pour identifier les produits ajoutés aux paniers, induit de la fonction déclarée de l'app.

read_orders
Medium

Le suivi de l'activité des paniers et des conversions nécessite la lecture des commandes, induit de la fonction déclarée de l'app.

read_script_tags
Low

La capture de l'activité des paniers repose généralement sur la lecture des scripts injectés dans la vitrine, induit de la fonction déclarée de l'app.

write_script_tags
Medium

Pour suivre les ajouts au panier, l'app doit injecter un script de suivi dans la boutique, induit de la fonction déclarée de l'app.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
cartactivity.com
TLS grade
A
HSTS
Missing
CSP
Missing

Served via AWS CloudFront; no HSTS or CSP response headers observed. cartactivity.com 302-redirects to www1.cartactivity.com.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy policy URL exists but page returned no substantive extractable content; no certifications confirmable from public sources.

Privacy policy
Track record

Publisher reputation

Publisher
Devels Advocates LLP
Verified Shopify Partner
No
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.