Starship
starship / search / ocs-worldwide-uk

Audit report

OCS Worldwide (UK)

Broad accessReach : moderateSensitive Access

by OCS Worldwide (UK) · Orders and shipping · Shopify App Store

Orders and shipping
Risk level
Broad access
Executive summary

Unbeatable Shipping Rates & Fast Transit Times

Key insights

  • ◆Shipping app by UK courier OCS Worldwide for generating UK/EU/international labels and auto-fulfillment.
  • ◆App URL resolves; publisher domain ocsworldwide.co.uk reachable over HTTPS (cert OK) but missing HSTS and CSP.
  • ◆No 'Built for Shopify' badge.
  • ◆Privacy notice is generic and omits sub-processors, data residency, retention, and compliance certifications.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Unbeatable Shipping Rates & Fast Transit Times

Key insights
  • ◆Shipping app by UK courier OCS Worldwide for generating UK/EU/international labels and auto-fulfillment.
  • ◆App URL resolves; publisher domain ocsworldwide.co.uk reachable over HTTPS (cert OK) but missing HSTS and CSP.
  • ◆No 'Built for Shopify' badge.
  • ◆Privacy notice is generic and omits sub-processors, data residency, retention, and compliance certifications.
  • ◆No public security breaches, CVEs, or incidents found tied to this publisher or app (OCS Inventory NG CVEs are an unrelated open-source project).
  • ◆OAuth scopes not visible on the listing page; shipping apps typically require read_orders and write_fulfillments.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_orders
High

Typical for shipping apps to read order shipping data; not explicitly declared on listing page.

write_fulfillments
High

Required to mark orders fulfilled with tracking; not explicitly declared on listing page.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
ocsworldwide.co.uk
TLS grade
A
HSTS
Missing
CSP
Missing

HTTPS reachable (LiteSpeed/WordPress). No strict-transport-security or content-security-policy headers observed. Permissions-Policy header present.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy notice present but lacks explicit GDPR/SOC2/ISO27001/PCI commitments. UK-based publisher implies UK GDPR applicability in practice but unconfirmed in public docs.

Privacy policy
Track record

Publisher reputation

Publisher
OCS Worldwide (UK)
Verified Shopify Partner
No
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.