starship / search / facebook-product-comments

Audit report

Facebook Comments

Broad accessReach : limited

by Architechpro OÜ · Customer support · Shopify App Store

Customer support

Risk level

Broad access

Executive summary

Add fb discussions to products and blogs

Key insights

◆Tiny social-proof widget app (last update 2018, 3 reviews) by Estonian publisher Architechpro OÜ, very small installed base and effectively unmaintained.
◆Publisher's own corporate site is a Shopify-hosted storefront fronted by Cloudflare with HSTS enabled and a minimal CSP, basic web hygiene present.
◆No public security incidents, CVEs, or breach disclosures found for Architechpro or this specific app.
◆Privacy posture is generic Shopify-app boilerplate: no sub-processor register, no retention schedule, no certifications.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Add fb discussions to products and blogs

Key insights

◆Tiny social-proof widget app (last update 2018, 3 reviews) by Estonian publisher Architechpro OÜ, very small installed base and effectively unmaintained.
◆Publisher's own corporate site is a Shopify-hosted storefront fronted by Cloudflare with HSTS enabled and a minimal CSP, basic web hygiene present.
◆No public security incidents, CVEs, or breach disclosures found for Architechpro or this specific app.
◆Privacy posture is generic Shopify-app boilerplate: no sub-processor register, no retention schedule, no certifications.
◆Functionality requires embedding Meta's Facebook Comments SDK on the storefront, adds a Meta data-flow surface independent of the app itself.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

App last updated in October 2018, abandoned/unmaintained

Medium

The Shopify listing shows the app was last updated on October 1, 2018, indicating roughly 8 years without security patches, dependency upgrades, or Shopify API version updates. Unmaintained apps accumulate vulnerabilities and may rely on deprecated Shopify APIs.

Evidence

https://apps.shopify.com/facebook-product-comments

Data transfers to Ukraine and US without explicit safeguards listed

Medium

Privacy policy declares personal data may be transferred to Estonia, Ukraine and the United States. No SCCs, IDTA, or Data Processing Addendum link is exposed publicly. EU merchants relying on GDPR Article 46 transfer mechanisms have no public evidence of safeguards.

Evidence

https://architechpro.com/pages/privacy-policy

No data retention period defined

Low

Privacy policy does not specify any retention duration for personal data collected, only describing deletion upon user request. This is a GDPR Article 5(1)(e) storage-limitation gap.

Evidence

https://architechpro.com/pages/privacy-policy

No formal compliance certifications disclosed

Low

No mention of SOC 2, ISO 27001, PCI DSS, or HIPAA. Only GDPR referenced indirectly via DPA.

Evidence

https://architechpro.com/pages/privacy-policy

App embeds third-party Facebook Comments plugin

Info

Functionality depends on Meta's Facebook Comments SDK loading on storefront, which means buyer browsing data may flow to Meta. Merchants must consider this in their own cookie/consent banner. No malicious behaviour identified, but this is a third-party tracking surface.

Evidence

https://apps.shopify.com/facebook-product-comments

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`unknown`	Info	Shopify listing page does not expose granular OAuth scopes publicly; for a Facebook comments embed widget, expected scopes are limited to read_themes/write_themes and possibly read_products for placement, but this cannot be confirmed without merchant install flow inspection.

unknown

Info

Shopify listing page does not expose granular OAuth scopes publicly; for a Facebook comments embed widget, expected scopes are limited to read_themes/write_themes and possibly read_products for placement, but this cannot be confirmed without merchant install flow inspection.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

architechpro.com

EU (Estonia HQ) · publisher backend/website

Declared

facebook.com

US (Meta) · Facebook Comments SDK embed for storefront UGC

Declared

google-analytics.com

US · publisher website analytics (per privacy policy)

Declared

Sub-processors

Google AnalyticsMeta/Facebook (Comments SDK)

Data residency: unknown

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: architechpro.com
TLS grade: unknown
HSTS: Enabled
CSP: Enabled

Publisher site is a Shopify-hosted store on Cloudflare. HSTS present (max-age=7889238, ~91 days). CSP minimal: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests, no explicit script-src/default-src lockdown. X-Frame-Options DENY, X-Content-Type-Options nosniff, X-XSS-Protection enabled.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

GDPR referenced via DPA; no SOC 2 / ISO 27001 / PCI DSS / HIPAA disclosures. No sub-processor register, no retention schedule, no SCCs published.

Track record

Publisher reputation

Publisher: Architechpro OÜ
Verified Shopify Partner: No
Years active: 8
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.