Starship
starship / search / now-in-stock-3

Audit report

Now in stock @ $3

WatchReach : moderate

by Mascot Software Technologies Pvt. Ltd · Store design · Shopify App Store

Store design
Risk level
Watch
Executive summary

Notify customers when a product is back in stock by email

Key insights

  • ◆Indian publisher (Mascot Software Technologies Pvt. Ltd) operating small Shopify utility apps under shopapps.in
  • ◆Publisher domain shopapps.in does not enforce HTTPS and shows a 2023 last-modified date suggesting low maintenance cadence
  • ◆Privacy policy itself is hosted over plain HTTP, significant trust signal failure
  • ◆Scope set is broad (theme, all orders, staff PII, customer geolocation) relative to the narrow restock-alert use case

Top findingsview all

  • High
    Publisher domain served over plain HTTP, no HTTPS redirect
  • High
    Broad customer PII access including geolocation/IP
Synthesis

Analysis summary

Notify customers when a product is back in stock by email

Key insights
  • ◆Indian publisher (Mascot Software Technologies Pvt. Ltd) operating small Shopify utility apps under shopapps.in
  • ◆Publisher domain shopapps.in does not enforce HTTPS and shows a 2023 last-modified date suggesting low maintenance cadence
  • ◆Privacy policy itself is hosted over plain HTTP, significant trust signal failure
  • ◆Scope set is broad (theme, all orders, staff PII, customer geolocation) relative to the narrow restock-alert use case
  • ◆No 'Built for Shopify' badge, no named sub-processors, no compliance certifications
  • ◆No publicly reported breaches or CVEs against the publisher or app
  • ◆Modest adoption: 4.4 rating across 54 reviews at $3/mo

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_customers
High

Customer name, email, geolocation, IP, browser/OS, broader than needed for restock alerts

read_orders
High

All order history; overbroad for a notification utility

read_products
Medium

Needed to detect inventory restock events

read_inventory
Medium

Core requirement for stock-level monitoring

read_themes
High

Theme access permits injection of storefront JS; risk if write is also granted

read_locations
Low

Needed for multi-location stock tracking

read_users
Medium

Staff PII access including phone and physical address, unusual for utility

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
shopapps.in
TLS grade
F
HSTS
Missing
CSP
Missing

Publisher domain serves over plain HTTP with no HTTPS redirect, no HSTS, no CSP. Apache server, last-modified Feb 2023. Privacy policy served over HTTP.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Policy references GDPR-style rights and cross-border transfers (Canada/US) but lists no formal certifications and names no sub-processors.

Privacy policy
Track record

Publisher reputation

Publisher
Mascot Software Technologies Pvt. Ltd
Verified Shopify Partner
No
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.