starship / search / epi

Audit report

eBay Professional Importer

Broad accessReach : broadSensitive Access

by InfoShore Software Private Limited · Finding and adding products · Shopify App Store

Finding and adding products

Risk level

Broad access

Executive summary

Easiest way to import products from your eBay Seller Account

Key insights

◆App last updated October 20, 2017 on the Shopify App Store, 9 years stale
◆4.9 stars across 347 reviews; not Built for Shopify
◆Edit scopes on products and orders (justified by eBay <-> Shopify sync) plus customer device/geolocation data
◆Publisher in Jaipur, India; data transferred to Canada and US; no SOC2/ISO27001/GDPR attestation

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Easiest way to import products from your eBay Seller Account

Key insights

◆App last updated October 20, 2017 on the Shopify App Store, 9 years stale
◆4.9 stars across 347 reviews; not Built for Shopify
◆Edit scopes on products and orders (justified by eBay <-> Shopify sync) plus customer device/geolocation data
◆Publisher in Jaipur, India; data transferred to Canada and US; no SOC2/ISO27001/GDPR attestation
◆No public breach, CVE, or security incident found for InfoShore or this app
◆API host apps.infoshoreapps.com fronted by Cloudflare; publisher marketing site on Apache without HSTS/CSP
◆No use of LLM/AI mentioned in policy

Detections

Findings (6)

Risks detected through static, network, and policy analysis.

Edit-level scopes for products and orders

Medium

App requests write access to products (inventory, products, publications, collections) and orders (fulfillment, order history). Justified by sync use case, but elevates blast radius if app or publisher is compromised.

Evidence

https://apps.shopify.com/epi

App listing not updated since October 2017

Medium

Last update date on the Shopify App Store is October 20, 2017, nearly 9 years stale. Indicates limited active maintenance, which raises supply-chain/security patching concerns despite a high rating.

Evidence

https://apps.shopify.com/epi

Cross-border data transfer to India / Canada / US with no certifications named

Medium

Privacy policy states data is transferred outside Europe to Canada and the United States; publisher's primary office is in Jaipur, India. No GDPR, SOC2, ISO27001, PCI DSS or HIPAA attestation is referenced.

Evidence

https://apps.infoshoreapps.com/epi/privacy-policy.html

Sub-processors not enumerated

Low

Privacy policy references generic 'third-party tools, integrations, or external synchronization software' but does not name specific sub-processors, limiting merchant due diligence.

Evidence

https://apps.infoshoreapps.com/epi/privacy-policy.html

Publisher website lacks HSTS and CSP headers

Low

https://www.infoshore.biz/ responds with HTTP/1.1 200 over HTTPS but does not advertise strict-transport-security or content-security-policy headers. The app domain (apps.infoshoreapps.com) sits behind Cloudflare which mitigates some of this for the API surface.

Evidence

https://www.infoshore.biz/

Indefinite order data retention

Low

Privacy policy states they 'maintain your Order Information for our records unless and until you ask us to delete this information', no maximum retention period defined.

Evidence

https://apps.infoshoreapps.com/epi/privacy-policy.html

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`write_products`	High	Edit products, inventory, publications, and collections, required for eBay->Shopify sync but high blast radius.
`write_orders`	High	Edit orders, fulfillment and 60 days of order history, sensitive for merchant operations.
`read_customers`	Medium	Customer device/activity data including geolocation, IP, browser and OS.
`read_users`	Medium	Store owner staff data: name, email, phone, physical address.
`read_metaobjects`	Low	View custom data (metaobjects).
`read_locations`	Low	View location data for inventory mapping.

write_products

High

Edit products, inventory, publications, and collections, required for eBay->Shopify sync but high blast radius.

write_orders

High

Edit orders, fulfillment and 60 days of order history, sensitive for merchant operations.

read_customers

Medium

Customer device/activity data including geolocation, IP, browser and OS.

read_users

Medium

Store owner staff data: name, email, phone, physical address.

read_metaobjects

Low

View custom data (metaobjects).

read_locations

Low

View location data for inventory mapping.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: infoshore.biz
TLS grade: A
HSTS: Missing
CSP: Missing

Publisher site on Apache without HSTS or CSP. App host apps.infoshoreapps.com proxied through Cloudflare which provides edge TLS and NEL reporting.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy mentions cross-border transfers to Canada and US but does not claim any certifications. Indefinite order retention.

Track record

Publisher reputation

Publisher: InfoShore Software Private Limited
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

eBay Professional Importer

Key insights

Top findings

Analysis summary

Findings (6)

Edit-level scopes for products and orders

App listing not updated since October 2017

Cross-border data transfer to India / Canada / US with no certifications named

Sub-processors not enumerated

Publisher website lacks HSTS and CSP headers

Indefinite order data retention

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage