starship / search / shipping-information-by-fireapps

Audit report

Sales Box ‑ Shipping Info

TrustedReach : broad

by FireApps - Premium Apps For Ecommerce. · Store design · Shopify App Store

Store design

Risk level

Trusted

Executive summary

Make more sales with free shipping, promo, discount message

Key insights

◆Sales Box is a free shipping bar / promotional banner app launched 2017 by FireApps, a Vietnam-based Shopify partner with 30,000+ merchant claims.
◆Storefront-overlay class app: typically injects theme assets or script tags rather than reading sensitive PII.
◆No 'Built for Shopify' badge on the listing; rating 3.8/5 across only 18 reviews.
◆Publisher domain fireapps.io runs WordPress on EOL PHP 7.4 behind Cloudflare; no HSTS/CSP.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Make more sales with free shipping, promo, discount message

Key insights

◆Sales Box is a free shipping bar / promotional banner app launched 2017 by FireApps, a Vietnam-based Shopify partner with 30,000+ merchant claims.
◆Storefront-overlay class app: typically injects theme assets or script tags rather than reading sensitive PII.
◆No 'Built for Shopify' badge on the listing; rating 3.8/5 across only 18 reviews.
◆Publisher domain fireapps.io runs WordPress on EOL PHP 7.4 behind Cloudflare; no HSTS/CSP.
◆Privacy policy is generic CCPA/GDPR boilerplate with no named sub-processors, no data-residency commitment, and no enumerated retention period.
◆No documented security breach, CVE, or incident publicly tied to FireApps or the Sales Box app.

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Publisher domain runs end-of-life PHP 7.4

Low

fireapps.io responds with X-Powered-By: PHP/7.4.22. PHP 7.4 reached end of life on 2022-11-28 and no longer receives security patches. This is the corporate marketing site, not the app backend, but indicates weak hygiene on public-facing publisher infrastructure.

Evidence

https://fireapps.io/

Publisher domain missing HSTS and CSP headers

Low

fireapps.io serves no Strict-Transport-Security header and no Content-Security-Policy header. While Cloudflare fronts TLS correctly (HTTP/2, no cert errors), absence of HSTS leaves users vulnerable to SSL-strip on first visit.

Evidence

https://fireapps.io/

Privacy policy lacks specific data retention period

Low

fireapps.io/privacy commits only to retaining personal information 'as long as necessary' without a numeric maximum, and does not enumerate named sub-processors, hosting region, or compliance certifications (no SOC2, ISO 27001, or PCI DSS attestations mentioned).

Evidence

https://fireapps.io/privacy/

App last meaningful update date not surfaced on listing

Info

App Store listing shows 'Launched June 21, 2017' but no explicit 'last updated' date. Combined with a low review count (18) and rating of 3.8 on a ~9-year-old listing, this suggests low active maintenance.

Evidence

https://apps.shopify.com/shipping-information-by-fireapps

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_products`	Low	Required to display product/collection info inside the shipping/promo bar.
`write_themes`	Medium	Free shipping bar UI is typically injected via theme app extension or theme edits; write_themes lets the app modify storefront markup.
`write_script_tags`	Medium	Legacy free shipping bars commonly inject a JS script tag on the storefront to render the bar client-side, which executes arbitrary code in the buyer's browser context.

read_products

Low

Required to display product/collection info inside the shipping/promo bar.

write_themes

Medium

Free shipping bar UI is typically injected via theme app extension or theme edits; write_themes lets the app modify storefront markup.

write_script_tags

Medium

Legacy free shipping bars commonly inject a JS script tag on the storefront to render the bar client-side, which executes arbitrary code in the buyer's browser context.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: fireapps.io
TLS grade: A
HSTS: Missing
CSP: Missing

Cloudflare-fronted WordPress; no HSTS, no CSP, X-Frame-Options SAMEORIGIN and X-Content-Type-Options nosniff present; X-Powered-By exposes PHP 7.4.22 (EOL).

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy mentions CCPA (separate page) and acknowledges EEA transfer obligations but makes no formal GDPR/SOC2/ISO/PCI attestation. Retention period not quantified.

Track record

Publisher reputation

Publisher: FireApps - Premium Apps For Ecommerce.
Verified Shopify Partner: No
Years active: 9
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Sales Box ‑ Shipping Info

Key insights

Top findings

Analysis summary

Findings (4)

Publisher domain runs end-of-life PHP 7.4

Publisher domain missing HSTS and CSP headers

Privacy policy lacks specific data retention period

App last meaningful update date not surfaced on listing

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage