Audit report
ShipNerd
Broad accessReach : broadSensitive Accessby ShipNerd · Orders and shipping · Shopify App Store
Use Our Volume Discounts To Ship With The Best
Key insights
- ◆ShipNerd is a free shipping rate aggregator for Shopify merchants (carrier discounts, label generation, pickups).
- ◆Rating 4.8/5 across 24 reviews (low review count suggests a niche/early-stage adoption).
- ◆Publisher infrastructure terminates on Cloudflare and runs on Heroku (US-region by default).
- ◆CSP allows Stripe, Google Maps, Google Fonts, Firestore, and Google APIs - so Stripe handles payments and Google Cloud (Firestore) likely holds operational data.
Top findings
Analysis summary
Use Our Volume Discounts To Ship With The Best
- ◆ShipNerd is a free shipping rate aggregator for Shopify merchants (carrier discounts, label generation, pickups).
- ◆Rating 4.8/5 across 24 reviews (low review count suggests a niche/early-stage adoption).
- ◆Publisher infrastructure terminates on Cloudflare and runs on Heroku (US-region by default).
- ◆CSP allows Stripe, Google Maps, Google Fonts, Firestore, and Google APIs - so Stripe handles payments and Google Cloud (Firestore) likely holds operational data.
- ◆No public security incidents, breaches, or CVEs found tied to ShipNerd or its publisher.
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedOAuth scopes requested
These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.
| Scope | Sensitivity | Why we flag it |
|---|---|---|
read_orders | High | Required to read orders to generate shipping labels - typical for a shipping app. |
write_orders | High | Typical for shipping apps to update fulfillment status, tracking numbers, and shipping info on orders. |
read_shipping | Medium | Needed to read shipping configuration and zones. |
write_shipping | Medium | Needed to configure shipping carriers and rates. |
read_fulfillments | Medium | Required to read fulfillment status to manage shipments. |
write_fulfillments | High | Required to create and update fulfillments after label generation. |
read_ordersRequired to read orders to generate shipping labels - typical for a shipping app.
write_ordersTypical for shipping apps to update fulfillment status, tracking numbers, and shipping info on orders.
read_shippingNeeded to read shipping configuration and zones.
write_shippingNeeded to configure shipping carriers and rates.
read_fulfillmentsRequired to read fulfillment status to manage shipments.
write_fulfillmentsRequired to create and update fulfillments after label generation.
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedThis section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedNetwork surface
- Primary domain
- shipnerd.com
- TLS grade
- A
- HSTS
- Enabled
- CSP
- Enabled
Strict CSP with allowlisted third parties (Stripe, Google Maps/Firestore, Google Fonts). HSTS 180 days with includeSubDomains. X-Frame-Options SAMEORIGIN. Cloudflare in front of Heroku origin.
Compliance & certifications
No formal privacy policy URL surfaced on the Shopify listing or on the publisher home page during this audit. PCI obligations effectively delegated to Stripe (no direct card handling indicated).
Privacy policyPublisher reputation
- Publisher
- ShipNerd
- Verified Shopify Partner
- No
- Years active
- 0
- Other apps
- 0