starship / search / nofraud-chargeback-prevention-and-protection

Audit report

NoFraud Fraud Prevention

Broad accessReach : broadSensitive Access

by NoFraud Fraud Prevention · Orders and shipping · Shopify App Store

Orders and shipping

Risk level

Broad access

Executive summary

Prevent Fraud Chargebacks, Accept More Orders

Key insights

◆Built for Shopify badge present; 4.9 rating across 146 reviews
◆Publisher rebranded from NoFraud to Wyllo (Wyllo, LLC)
◆Publishes a dedicated security page claiming PCI L1 and SOC 2 Type II
◆AWS-hosted with intrusion detection and annual pentesting

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Prevent Fraud Chargebacks, Accept More Orders

Key insights

◆Built for Shopify badge present; 4.9 rating across 146 reviews
◆Publisher rebranded from NoFraud to Wyllo (Wyllo, LLC)
◆Publishes a dedicated security page claiming PCI L1 and SOC 2 Type II
◆AWS-hosted with intrusion detection and annual pentesting
◆Privacy policy is generic and omits sub-processor list specifics, data residency, and concrete retention windows
◆No public CVEs or confirmed breaches surfaced in web search

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

PCI DSS Level 1 + SOC 2 Type II certified

Info

Publisher (Wyllo, formerly NoFraud) publishes a security page asserting PCI Level 1 and SOC 2 Type II compliance, annual pentests, AWS hosting with intrusion detection, and a 24-hour vulnerability acknowledgement SLA.

Evidence

https://wyllo.ai/security/

Privacy policy lacks explicit data residency and retention windows

Low

Privacy policy mentions transfers outside user jurisdiction and uses vague 'reasonable period' / 'ongoing legitimate business need' language rather than concrete retention windows or named hosting regions.

Evidence

https://wyllo.ai/privacy/

No HSTS header on publisher root

Low

curl -I against https://wyllo.ai/ returns 200 with CSP frame-ancestors but no Strict-Transport-Security header; site is fronted by Cloudflare with valid TLS.

Evidence

https://wyllo.ai/

Fraud-prevention scope implies access to orders, customers, and risk data

Medium

As a fraud/chargeback prevention app reviewing every order, it requires sensitive scopes (read_orders, read_customers, read_checkouts, write_orders for cancellations/refunds) to function. Sensitive but justified by the stated purpose.

Evidence

https://apps.shopify.com/nofraud-chargeback-prevention-and-protection

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	High	Required to screen orders for fraud signals
`write_orders`	High	Needed to cancel/refund fraudulent orders automatically
`read_customers`	High	Identity signal scoring relies on customer profile data
`read_checkouts`	High	Behavioral analysis at checkout for bot/reseller detection
`read_fulfillments`	Medium	Used for return-fraud and post-order abuse analysis

read_orders

High

Required to screen orders for fraud signals

write_orders

High

Needed to cancel/refund fraudulent orders automatically

read_customers

High

Identity signal scoring relies on customer profile data

read_checkouts

High

Behavioral analysis at checkout for bot/reseller detection

read_fulfillments

Medium

Used for return-fraud and post-order abuse analysis

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: wyllo.ai
TLS grade: A
HSTS: Missing
CSP: Enabled

Cloudflare-fronted, CSP limited to frame-ancestors; no HSTS header observed

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Pass

ISO 27001 Fail

PCI DSS Pass

Publisher claims PCI DSS Level 1 and SOC 2 Type II on security page; GDPR/CCPA not explicitly enumerated though privacy policy covers cross-border transfers

Track record

Publisher reputation

Publisher: NoFraud Fraud Prevention
Verified Shopify Partner: Yes
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

NoFraud Fraud Prevention

Key insights

Top findings

Analysis summary

Findings (4)

PCI DSS Level 1 + SOC 2 Type II certified

Privacy policy lacks explicit data residency and retention windows

No HSTS header on publisher root

Fraud-prevention scope implies access to orders, customers, and risk data

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage