starship / search / editorify

Audit report

Reviews Importer ‑ Editorify

Broad accessReach : broadSensitive Access

by importify · Store design · Shopify App Store

Store design

Risk level

Broad access

Executive summary

Import Reviews from Aliexpress Amazon Etsy Dhgate Wish & More

Key insights

◆Reviews importer pulling content from AliExpress / Alibaba / Etsy / Temu / Taobao / 1688 (dropshipping-focused review aggregator).
◆Launched September 8, 2016 on the Shopify App Store; rating 4.8/5 across 67 reviews.
◆Publisher is Importify Limited (Hong Kong); same vendor as the Importify dropshipping app.
◆No 'Built for Shopify' badge observed on listing.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Import Reviews from Aliexpress Amazon Etsy Dhgate Wish & More

Key insights

◆Reviews importer pulling content from AliExpress / Alibaba / Etsy / Temu / Taobao / 1688 (dropshipping-focused review aggregator).
◆Launched September 8, 2016 on the Shopify App Store; rating 4.8/5 across 67 reviews.
◆Publisher is Importify Limited (Hong Kong); same vendor as the Importify dropshipping app.
◆No 'Built for Shopify' badge observed on listing.
◆Scopes include edit theme + script tags + view customer data + 60-day order history.
◆No public CVE, breach, or security incident attributable to Editorify or Importify Limited found in search.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

Edit Online Store theme + script tags access

Medium

App requests permission to edit Online Store pages, script tags, and theme. Script tag injection can execute arbitrary JS on storefront pages, expanding the attack surface if publisher's pipeline is ever compromised.

Evidence

https://apps.shopify.com/editorify

Sensitive customer data scope (name, email, geolocation, IP)

Medium

App collects sensitive customer data (name, email) plus device/activity data (geolocation, IP, UA) on a storefront-injected widget. Combined with edit-Online-Store access this raises a moderate privacy footprint.

Evidence

https://apps.shopify.com/editorify

No HSTS / CSP on publisher domain

Low

https://editorify.com/ response headers (nginx) include no Strict-Transport-Security and no Content-Security-Policy. Below modern web security baseline for a vendor handling merchant data.

Evidence

https://editorify.com/

No named sub-processors or compliance certifications in privacy policy

Low

Privacy policy lists only generic categories of sub-processors (hosting, IT, mail), names no specific vendors, and asserts no GDPR/CCPA/SOC2/ISO27001/PCI DSS certifications. Retention periods are described in vague legal terms only.

Evidence

https://www.editorify.com/privacy-policy/

Publisher / data controller based in Hong Kong

Low

Importify Limited is registered in Sheung Wan, Hong Kong. Data residency is unspecified and the privacy policy acknowledges cross-border transfers outside the EU, with no SCCs or transfer mechanism documented.

Evidence

https://www.editorify.com/privacy-policy/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Customer PII (name, email) used to attribute reviews to buyers.
`write_products`	High	Edits products and collections to attach imported reviews / metafields.
`read_orders`	Medium	Last-60-days order history, scoped (not read_all_orders).
`write_themes`	High	Edits Online Store theme to render review widgets.
`write_script_tags`	High	Injects script tags on storefront pages; powerful primitive if publisher is compromised.
`write_online_store_pages`	Medium	Edits Online Store pages to embed review blocks.

read_customers

High

Customer PII (name, email) used to attribute reviews to buyers.

write_products

High

Edits products and collections to attach imported reviews / metafields.

read_orders

Medium

Last-60-days order history, scoped (not read_all_orders).

write_themes

High

Edits Online Store theme to render review widgets.

write_script_tags

High

Injects script tags on storefront pages; powerful primitive if publisher is compromised.

write_online_store_pages

Medium

Edits Online Store pages to embed review blocks.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: editorify.com
TLS grade: A
HSTS: Missing
CSP: Missing

HTTPS reachable cleanly (HTTP/2 200 via nginx); WordPress-backed marketing site; no HSTS or CSP headers observed.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy references EU/non-EU transfer language but asserts no formal certifications. Owner/controller: Importify Limited, Hong Kong.

Track record

Publisher reputation

Publisher: importify
Verified Shopify Partner: No
Years active: 9
Other apps: 1

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Reviews Importer ‑ Editorify

Key insights

Top findings

Analysis summary

Findings (5)

Edit Online Store theme + script tags access

Sensitive customer data scope (name, email, geolocation, IP)

No HSTS / CSP on publisher domain

No named sub-processors or compliance certifications in privacy policy

Publisher / data controller based in Hong Kong

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage