Starship
starship / search / my-online-fashion-store

Audit report

MY ONLINE FASHION BY CCFASHION

Broad accessReach : broadSensitive Access

by ccwholesaleclothing · Finding and adding products · Shopify App Store

Finding and adding products
Risk level
Broad access
Executive summary

US based Dropshipper – Over 4000 Fashion Items - Free Trial

Key insights

  • ◆Dropshipping app: publisher CC Wholesale Clothing (Los Angeles) supplies inventory shipped from its own warehouse, requiring both product and order write scopes.
  • ◆Rating 4.6 over 89 reviews; no 'Built for Shopify' badge.
  • ◆Publisher website is itself a Shopify store (powered-by: Shopify, Cloudflare-fronted), with HSTS and a minimal CSP applied by Shopify defaults.
  • ◆Privacy policy is generic Shopify-merchant boilerplate; references invalidated EU-US Privacy Shield and names only Shopify and social platforms as third parties.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

US based Dropshipper – Over 4000 Fashion Items - Free Trial

Key insights
  • ◆Dropshipping app: publisher CC Wholesale Clothing (Los Angeles) supplies inventory shipped from its own warehouse, requiring both product and order write scopes.
  • ◆Rating 4.6 over 89 reviews; no 'Built for Shopify' badge.
  • ◆Publisher website is itself a Shopify store (powered-by: Shopify, Cloudflare-fronted), with HSTS and a minimal CSP applied by Shopify defaults.
  • ◆Privacy policy is generic Shopify-merchant boilerplate; references invalidated EU-US Privacy Shield and names only Shopify and social platforms as third parties.
  • ◆No public security breaches, CVEs, or incidents found for publisher or app.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_customers
High

Customer PII (name, email, phone, address) exposed to publisher for fulfillment.

write_products
Medium

Required to push dropship catalog (products, inventory, collections, publications) into the merchant store.

write_orders
High

Required to receive orders and write fulfillment data; broad write access to assigned/merchant-managed/third-party fulfillment plus 60-day order history.

read_store_information
Low

Store owner name/email/phone/address used for account contact.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
myonlinefashionstore.com
TLS grade
A
HSTS
Enabled
CSP
Enabled

HSTS max-age=7889238; CSP set to 'block-all-mixed-content; frame-ancestors none; upgrade-insecure-requests' (Shopify default). Cloudflare edge with X-Frame-Options DENY and X-Content-Type-Options nosniff.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy policy references invalidated EU-US Privacy Shield; no GDPR/CCPA/SOC2/ISO/PCI/HIPAA certifications claimed; retention period not quantified.

Privacy policy
Track record

Publisher reputation

Publisher
ccwholesaleclothing
Verified Shopify Partner
No
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.