starship / search / email-my-webhooks-1

Audit report

Email My Webhooks

Broad accessReach : moderateSensitive Access

by Student · Customer support · Shopify App Store

Customer support

Risk level

Broad access

Executive summary

Get email notifications when customers sign up to your store!

Key insights

◆Publisher listed as 'Student' on App Store; suggests hobbyist developer rather than registered company.
◆Only 4 reviews and 3.0 rating; very low install base / limited operational track record.
◆Privacy policy served over plain HTTP and is effectively empty for compliance content.
◆Publisher domain returns a 114-byte response with no HSTS/CSP - landing-only infrastructure.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Get email notifications when customers sign up to your store!

Key insights

◆Publisher listed as 'Student' on App Store; suggests hobbyist developer rather than registered company.
◆Only 4 reviews and 3.0 rating; very low install base / limited operational track record.
◆Privacy policy served over plain HTTP and is effectively empty for compliance content.
◆Publisher domain returns a 114-byte response with no HSTS/CSP - landing-only infrastructure.
◆No CVEs, breaches, or security incidents found in public sources for this app or publisher.
◆App forwards Shopify webhook payloads (orders, customers, products) to email; sensitive PII transits a third-party SMTP path.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Privacy policy hosted on plain HTTP and lacks any compliance content

Medium

Privacy policy URL is http://emailmywebhooks.com/privacy_policy.html. When fetched, the page returned no extractable content for data residency, sub-processors, AI usage, retention or compliance frameworks (GDPR/CCPA/SOC2/ISO27001/PCI/HIPAA). The publisher's site itself returns a 114-byte HTML response with no security headers (no HSTS, no CSP).

Evidence

http://emailmywebhooks.com/privacy_policy.html

Publisher identified as 'Student' on Shopify App Store

Medium

The publisher field on the App Store listing is 'Student' rather than a registered company name. Combined with only 4 reviews and a 3.0 rating, this indicates a low-maturity vendor with limited operational accountability.

Evidence

https://apps.shopify.com/email-my-webhooks-1

Publisher infrastructure lacks security headers

Low

HTTP response headers from emailmywebhooks.com show no Strict-Transport-Security, no Content-Security-Policy, and a minimal 114-byte response body indicating a placeholder/landing-only site rather than a hardened product surface.

Evidence

https://emailmywebhooks.com/

App likely consumes Shopify webhooks for orders/customers/products (forwarded by email)

Low

App description states it sends email notifications for customer account changes, order status updates, and product modifications - implying webhook subscriptions for orders, customers, and products. Specific OAuth scopes are not declared on the listing page extract.

Evidence

https://apps.shopify.com/email-my-webhooks-1

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	High	Likely required to subscribe to order webhooks and email order status updates (inferred from description; not explicitly declared).
`read_customers`	High	Customer account change notifications require customer data access (inferred).
`read_products`	Medium	Product modification notifications require product read access (inferred).

read_orders

High

Likely required to subscribe to order webhooks and email order status updates (inferred from description; not explicitly declared).

read_customers

High

Customer account change notifications require customer data access (inferred).

read_products

Medium

Product modification notifications require product read access (inferred).

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: emailmywebhooks.com
TLS grade: A
HSTS: Missing
CSP: Missing

Publisher domain returns HTTP 200 with only Content-Type/Date/Content-Length headers; 114-byte body indicates landing page only. No HSTS, no CSP, no other defensive headers.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy URL is plain HTTP and returns no extractable compliance content; no GDPR/CCPA/SOC2/ISO27001/PCI/HIPAA assertions found.

Track record

Publisher reputation

Publisher: Student
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Email My Webhooks

Key insights

Top findings

Analysis summary

Findings (4)

Privacy policy hosted on plain HTTP and lacks any compliance content

Publisher identified as 'Student' on Shopify App Store

Publisher infrastructure lacks security headers

App likely consumes Shopify webhooks for orders/customers/products (forwarded by email)

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage