Audit report
ShipRelay Fulfillment
Broad accessReach : broadSensitive Accessby ShipRelay, Inc. · Orders and shipping · Shopify App Store
Omni-Channel Fulfillment and Inventory Management Software
Key insights
- ◆ShipRelay is a 3PL fulfillment provider headquartered in Chatsworth, CA, USA
- ◆App is not 'Built for Shopify' certified
- ◆Publisher domain runs on Cloudflare in front of a Bluehost/WordPress origin (host-header reveals shared.bluehost.com)
- ◆TLS is healthy (valid HTTP/2 200), but security headers are minimal
Top findings
Analysis summary
Omni-Channel Fulfillment and Inventory Management Software
- ◆ShipRelay is a 3PL fulfillment provider headquartered in Chatsworth, CA, USA
- ◆App is not 'Built for Shopify' certified
- ◆Publisher domain runs on Cloudflare in front of a Bluehost/WordPress origin (host-header reveals shared.bluehost.com)
- ◆TLS is healthy (valid HTTP/2 200), but security headers are minimal
- ◆No public CVEs, breaches, or security incidents attributable to ShipRelay were found
- ◆OAuth scopes not exposed on the Shopify App Store listing page
- ◆Privacy policy is generic, omits residency, certifications, and explicit sub-processor list
- ◆No AI/LLM usage disclosed
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedOAuth scopes requested
These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.
| Scope | Sensitivity | Why we flag it |
|---|---|---|
read_orders | Medium | L'application doit lire les commandes pour traiter les expeditions, ce qui expose des donnees clients, induit de la fonction declaree de l'app. |
write_orders | Medium | La mise a jour du statut des commandes lors de l'expedition necessite un acces en ecriture, induit de la fonction declaree de l'app. |
read_fulfillments | Medium | Le suivi des expeditions suppose la lecture des elements de traitement des commandes, induit de la fonction declaree de l'app. |
write_fulfillments | Medium | La creation et la mise a jour des expeditions requiert un acces en ecriture aux fulfillments, induit de la fonction declaree de l'app. |
read_shipping | Low | Le respect des exigences d'expedition suppose la lecture des parametres de livraison, induit de la fonction declaree de l'app. |
read_products | Low | L'expedition necessite la lecture des produits pour identifier les articles a preparer, induit de la fonction declaree de l'app. |
read_inventory | Low | La gestion d'un service d'expedition suppose la lecture des niveaux de stock, induit de la fonction declaree de l'app. |
write_inventory | Low | En tant que departement d'expedition, l'application peut ajuster les stocks apres preparation, induit de la fonction declaree de l'app. |
read_ordersL'application doit lire les commandes pour traiter les expeditions, ce qui expose des donnees clients, induit de la fonction declaree de l'app.
write_ordersLa mise a jour du statut des commandes lors de l'expedition necessite un acces en ecriture, induit de la fonction declaree de l'app.
read_fulfillmentsLe suivi des expeditions suppose la lecture des elements de traitement des commandes, induit de la fonction declaree de l'app.
write_fulfillmentsLa creation et la mise a jour des expeditions requiert un acces en ecriture aux fulfillments, induit de la fonction declaree de l'app.
read_shippingLe respect des exigences d'expedition suppose la lecture des parametres de livraison, induit de la fonction declaree de l'app.
read_productsL'expedition necessite la lecture des produits pour identifier les articles a preparer, induit de la fonction declaree de l'app.
read_inventoryLa gestion d'un service d'expedition suppose la lecture des niveaux de stock, induit de la fonction declaree de l'app.
write_inventoryEn tant que departement d'expedition, l'application peut ajuster les stocks apres preparation, induit de la fonction declaree de l'app.
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedThis section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedNetwork surface
- Primary domain
- shiprelay.com
- TLS grade
- A
- HSTS
- Missing
- CSP
- Enabled
CSP set to only 'upgrade-insecure-requests' (no script-src/default-src), minimal protection. No HSTS. Cloudflare fronts a WordPress/Bluehost origin.
Compliance & certifications
Privacy policy present but does not claim any certifications and does not specify data residency or retention timelines.
Privacy policyPublisher reputation
- Publisher
- ShipRelay, Inc.
- Verified Shopify Partner
- No
- Years active
- 0
- Other apps
- 0