starship / search / shiphero

Audit report

ShipHero Inventory & Shipping

Broad accessReach : broadSensitive Access

by ShipHero · Inventory management · Shopify App Store

Inventory management

Risk level

Broad access

Executive summary

The complete inventory, order management and shipping solution

Key insights

◆Built for Shopify badge present; rating 4.5/5 with 99 reviews; launched February 14, 2014 (12+ years on the App Store).
◆Privacy policy is detailed and discloses sub-processors including AWS and Anthropic.
◆Primary domain shiphero.com is on Cloudflare with valid TLS, HSTS (max-age=31536000; includeSubDomains; preload).
◆ShipHero runs a public Bug Bounty Program, positive vulnerability disclosure signal.

Top findingsview all

High
Broad write scopes (customers, products, orders)

Synthesis

Analysis summary

The complete inventory, order management and shipping solution

Key insights

◆Built for Shopify badge present; rating 4.5/5 with 99 reviews; launched February 14, 2014 (12+ years on the App Store).
◆Privacy policy is detailed and discloses sub-processors including AWS and Anthropic.
◆Primary domain shiphero.com is on Cloudflare with valid TLS, HSTS (max-age=31536000; includeSubDomains; preload).
◆ShipHero runs a public Bug Bounty Program, positive vulnerability disclosure signal.
◆No publicly reported breach or CVE attributable to ShipHero found in web searches.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Broad write scopes (customers, products, orders)

High

ShipHero requests Edit customers, Edit products, and Edit orders, three high-sensitivity write scopes covering PII, inventory and full order history. Justified for a WMS/3PL fulfillment app but represents a large blast radius if the publisher were compromised.

Evidence

https://apps.shopify.com/shiphero

AI Help Bot processes customer data via Anthropic

Low

ShipHero discloses an AI Help Bot powered by Anthropic Claude API with 12-month retention; vendor states no training on customer data. Disclosed in privacy policy.

Evidence

https://shiphero.com/privacy-data-policy/

No explicit SOC2/ISO27001/PCI DSS certifications in public privacy policy

Low

Public privacy-data policy lists GDPR/CCPA/PIPEDA/Quebec Law 25 alignment but does not name SOC2, ISO27001, PCI DSS, or HIPAA certifications. A dedicated security page exists, but no formal certs surfaced in the audited document.

Evidence

https://shiphero.com/privacy-data-policy/

Limited Content-Security-Policy on primary domain

Info

shiphero.com returns only `content-security-policy: frame-ancestors 'self'`, covers clickjacking but no script-src/default-src directives.

Evidence

https://www.shiphero.com/

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`write_customers`	High	Edit customers, PII access required to sync recipient details to warehouse/shipping labels.
`write_products`	High	Edit products, inventory, collections, publications, core WMS function to push inventory levels back to Shopify.
`write_orders`	High	Edit orders, fulfillments, order edits, shipping info, required for a fulfillment/3PL platform.
`read_locations`	Low	View locations, needed to route inventory to correct warehouse/store location.

write_customers

High

Edit customers, PII access required to sync recipient details to warehouse/shipping labels.

write_products

High

Edit products, inventory, collections, publications, core WMS function to push inventory levels back to Shopify.

write_orders

High

Edit orders, fulfillments, order edits, shipping info, required for a fulfillment/3PL platform.

read_locations

Low

View locations, needed to route inventory to correct warehouse/store location.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

shiphero.com

US · Primary WMS platform / API

Declared

aws.amazon.com

US · Cloud hosting (AWS)

Declared

api.anthropic.com

US · AI Help Bot LLM provider

Declared

Sub-processors

AWSAnthropicGoogle AnalyticsHubSpotMeta/FacebookLinkedInTwitter/XZoomHockeyStackChiliPiperCharm.ioUnbounceOutreachClearbitGongPostHogShopify

Data residency: US

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: shiphero.com
TLS grade: A
HSTS: Enabled
CSP: Missing

HSTS present with 1-year max-age + includeSubDomains + preload. Only frame-ancestors CSP directive set; no script-src/default-src restrictions on marketing site.

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Policy explicitly addresses GDPR, CCPA, PIPEDA, Quebec Law 25. SOC2/ISO27001/PCI DSS/HIPAA not named in the audited privacy policy document.

Track record

Publisher reputation

Publisher: ShipHero
Verified Shopify Partner: Yes
Years active: 12
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

LLM providers

Anthropic

Data shared with providers

Customer support chat content sent to Anthropic Claude API for AI Help Bot responses; vendor contractually does not train on customer data.

Retention policy

12 months for AI Help Bot conversations