starship / search / myparcel-be-1

Audit report

MyParcel BE

Broad accessReach : broadSensitive Access

by MyParcel · Orders and shipping · Shopify App Store

Orders and shipping

Risk level

Broad access

Executive summary

Voordelig en gemakkelijk pakketten versturen met SendMyParcel

Key insights

◆Carrier/shipping label app for Belgium operated by MyParcel (Dutch/Belgian carrier integrator).
◆Low review volume (10 reviews, rating 4.3) suggesting niche regional usage.
◆Publisher primary domain is sendmyparcel.be (WordPress on nginx, PHP 8.1.34).
◆App Store page links the generic Shopify privacy URL rather than a publisher-specific privacy page.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Voordelig en gemakkelijk pakketten versturen met SendMyParcel

Key insights

◆Carrier/shipping label app for Belgium operated by MyParcel (Dutch/Belgian carrier integrator).
◆Low review volume (10 reviews, rating 4.3) suggesting niche regional usage.
◆Publisher primary domain is sendmyparcel.be (WordPress on nginx, PHP 8.1.34).
◆App Store page links the generic Shopify privacy URL rather than a publisher-specific privacy page.
◆No publicly disclosed Shopify-app-specific breaches or CVEs found for MyParcel BE.
◆One historical CVE exists for the same publisher's WordPress plugin (reflected XSS, fixed in 4.24.2).

Detections

Findings (3)

Risks detected through static, network, and policy analysis.

Related WordPress plugin had reflected XSS (CVE published, fixed 4.24.2)

Medium

The publisher's WordPress MyParcel plugin (woocommerce-myparcel) up to 4.24.1 had a reflected cross-site scripting vulnerability allowing script/HTML injection. Fixed in 4.24.2. Indicates a historical security-hygiene gap in the same publisher's ecosystem, though not specific to the Shopify app.

Evidence

https://patchstack.com/database/wordpress/plugin/woocommerce-myparcel/vulnerability/wordpress-myparcel-plugin-4-24-1-reflected-cross-site-scripting-vulnerability

Publisher policy bundles privacy + terms + cookie + DPA into one URL

Low

The publisher's privacy/terms/cookie/DPA policies are all consolidated under a single 'Voorwaarden & beleid' URL with PDF references. Reduces transparency for sub-processors, data residency, and retention versus standalone GDPR-style pages.

Evidence

https://www.sendmyparcel.be/voorwaarden/

Publisher exposes PHP version in HTTP headers

Info

The publisher's marketing site (sendmyparcel.be) returns 'x-powered-by: PHP/8.1.34' which leaks runtime fingerprint. Minor hygiene issue on the marketing site, not the Shopify app backend.

Evidence

https://www.sendmyparcel.be/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	High	Required to create shipping labels for Shopify orders; gives visibility to customer PII (name/address).
`write_orders`	High	Needed to attach tracking numbers/fulfillments; allows modifying orders.
`read_customers`	High	Address details required for label printing - PII exposure.
`write_fulfillments`	Medium	Required to mark orders fulfilled after label creation.
`read_products`	Low	Needed for item weight/dimensions on customs declarations.

read_orders

High

Required to create shipping labels for Shopify orders; gives visibility to customer PII (name/address).

write_orders

High

Needed to attach tracking numbers/fulfillments; allows modifying orders.

read_customers

High

Address details required for label printing - PII exposure.

write_fulfillments

Medium

Required to mark orders fulfilled after label creation.

read_products

Low

Needed for item weight/dimensions on customs declarations.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: sendmyparcel.be
TLS grade: A
HSTS: Missing
CSP: Missing

HTTPS valid (HTTP/2 200, nginx). No HSTS or CSP headers detected on root page. x-powered-by leaks PHP/8.1.34.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

EU/BE operator, DPA referenced in consolidated policy page; explicit SOC2/ISO27001/PCI certifications not advertised.

Track record

Publisher reputation

Publisher: MyParcel
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

MyParcel BE

Key insights

Top findings

Analysis summary

Findings (3)

Related WordPress plugin had reflected XSS (CVE published, fixed 4.24.2)

Publisher policy bundles privacy + terms + cookie + DPA into one URL

Publisher exposes PHP version in HTTP headers

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage