Starship
starship / search / news-sliders-by-widgetic

Audit report

Widgetic (News Headlines)

TrustedReach : broad

by Widgetic · Store design · Shopify App Store

Store design
Risk level
Trusted
Executive summary

Let your visitors know about important company news.

Key insights

  • ◆App is a frontend news-ticker widget; surface area appears limited to theme/page-builder embed.
  • ◆Shopify App Store page does not declare any OAuth scopes block.
  • ◆0 reviews, 0.0 rating, no 'Built for Shopify' badge, low signal of vetting.
  • ◆Publisher website widgetic.com served over HTTPS with HSTS via Cloudflare/Caddy; no CSP header observed.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Let your visitors know about important company news.

Key insights
  • ◆App is a frontend news-ticker widget; surface area appears limited to theme/page-builder embed.
  • ◆Shopify App Store page does not declare any OAuth scopes block.
  • ◆0 reviews, 0.0 rating, no 'Built for Shopify' badge, low signal of vetting.
  • ◆Publisher website widgetic.com served over HTTPS with HSTS via Cloudflare/Caddy; no CSP header observed.
  • ◆No CVEs or breach reports found for Widgetic the publisher; CVE hits returned were for an unrelated WordPress 'Widget Options' plugin.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_content
Low

L'application affiche des bandeaux d'actualité et de promotions, ce qui suppose la lecture du contenu de la boutique, induit de la fonction déclarée de l'app.

write_content
Low

La création et l'insertion de widgets d'actualité dans les pages nécessitent l'écriture de contenu, induit de la fonction déclarée de l'app.

read_themes
Low

L'intégration d'un widget de design dans la vitrine requiert la lecture du thème, induit de la fonction déclarée de l'app.

write_themes
Medium

L'ajout d'éléments visuels dans les pages peut impliquer la modification du thème, induit de la fonction déclarée de l'app.

write_script_tags
Medium

L'affichage dynamique de bandeaux promotionnels peut reposer sur l'injection de scripts dans la vitrine, induit de la fonction déclarée de l'app.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
widgetic.com
TLS grade
A
HSTS
Enabled
CSP
Missing

HSTS present (max-age=63072000; includeSubDomains plus a preload variant). No Content-Security-Policy header observed. Served behind Cloudflare with Caddy/nginx upstream.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy policy page reachable but fetched content did not surface explicit GDPR/CCPA/SOC2/ISO27001/PCI/HIPAA claims or retention periods.

Privacy policy
Track record

Publisher reputation

Publisher
Widgetic
Verified Shopify Partner
No
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.