starship / search / nudgify

Audit report

Nudgify Social Proof, FOMO...

Broad accessReach : broadSensitive Access

by Convertize · Sales and conversion optimization · Shopify App Store

Sales and conversion optimization

Risk level

Broad access

Executive summary

Social Proof, Urgency & Sales pop notifications

Key insights

◆Social proof / FOMO notification app with 4.5 rating and 66 reviews; not Built for Shopify certified
◆Publisher Convertize is UK-based; data hosted in EU/UK per policy
◆Publisher has a public CSRF CVE on their WordPress plugin (CVE-2024-31239) - signals weaker secure-coding hygiene
◆Broad write_customers / write_orders / write_products scopes requested though core feature is display-only social proof

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Social Proof, Urgency & Sales pop notifications

Key insights

◆Social proof / FOMO notification app with 4.5 rating and 66 reviews; not Built for Shopify certified
◆Publisher Convertize is UK-based; data hosted in EU/UK per policy
◆Publisher has a public CSRF CVE on their WordPress plugin (CVE-2024-31239) - signals weaker secure-coding hygiene
◆Broad write_customers / write_orders / write_products scopes requested though core feature is display-only social proof
◆Privacy policy is generic - does not name sub-processors or list compliance certifications

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

CSRF vulnerability in publisher's WordPress plugin (CVE-2024-31239)

Medium

Publisher Convertize/Nudgify shipped a Cross-Site Request Forgery vulnerability in the Nudgify Social Proof, Sales Popup & FOMO WordPress plugin (versions <= 1.3.3, CVSS 4.3). While this affects the WordPress plugin and not directly the Shopify app, it indicates the publisher has historically shipped insecure code. Fixed in 1.3.4.

Evidence

https://patchstack.com/database/vulnerability/nudgify/wordpress-nudgify-social-proof-sales-popup-fomo-plugin-1-3-3-cross-site-request-forgery-csrf-vulnerability

Broad write_* scopes including customer/order/product modification

Medium

App requests permission to edit store data (customers, products, orders, Online Store) although the core feature is read-only social proof notifications. Write access to customers/orders is broader than needed for displaying purchase notifications.

Evidence

https://apps.shopify.com/nudgify

Privacy policy lacks named sub-processors and certifications

Low

Nudgify privacy policy does not name specific sub-processors (only generic categories), lacks explicit compliance certifications (SOC2/ISO27001/PCI-DSS), and only references EU/UK hosting without naming specific providers. Retention is at least 25 months.

Evidence

https://www.nudgify.com/privacy/

Publisher website missing key hardening headers (HSTS, CSP)

Low

Convertize/Nudgify primary domain (www.nudgify.com) is served via Cloudflare with valid TLS but response headers do not include Strict-Transport-Security or Content-Security-Policy. Site is built on WordPress.

Evidence

https://www.nudgify.com/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Customer PII access for social proof notifications
`write_customers`	High	Write access not needed for read-only notification display
`read_orders`	High	Needed to display recent purchase notifications
`write_orders`	Critical	Write access to orders is excessive for a notification display app
`read_products`	Medium	Needed to associate notifications with products
`write_products`	High	Write access to products not justified by core feature
`read_online_store`	Medium	Theme/storefront read for widget injection
`write_online_store`	High	Storefront write enables theme code modification
`read_users`	Medium	Staff/contributor visibility - unusual scope for social proof

read_customers

High

Customer PII access for social proof notifications

write_customers

High

Write access not needed for read-only notification display

read_orders

High

Needed to display recent purchase notifications

write_orders

Critical

Write access to orders is excessive for a notification display app

read_products

Medium

Needed to associate notifications with products

write_products

High

Write access to products not justified by core feature

read_online_store

Medium

Theme/storefront read for widget injection

write_online_store

High

Storefront write enables theme code modification

read_users

Medium

Staff/contributor visibility - unusual scope for social proof

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: www.nudgify.com
TLS grade: A
HSTS: Missing
CSP: Missing

Cloudflare-fronted WordPress site; missing HSTS and CSP headers; valid TLS

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

GDPR-aligned (EU/UK hosted, retention disclosed); no SOC2/ISO27001/PCI certifications stated; no named sub-processors

Track record

Publisher reputation

Publisher: Convertize
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

●CVE

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Nudgify Social Proof, FOMO...

Key insights

Top findings

Analysis summary

Findings (4)

CSRF vulnerability in publisher's WordPress plugin (CVE-2024-31239)

Broad write_* scopes including customer/order/product modification

Privacy policy lacks named sub-processors and certifications

Publisher website missing key hardening headers (HSTS, CSP)

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage