Starship
starship / search / shiprobot

Audit report

ShipRobot

CriticalReach : broad

by ShipRobot LLC · Orders and shipping · Shopify App Store

Orders and shipping
Risk level
Critical
Executive summary

Multi-carrier and Multi-channel Shipping Labels

Key insights

  • ◆Shipping/label app for Shopify by ShipRobot LLC (San Francisco, founded 2015).
  • ◆Rating 4.6 with only ~22 reviews; not 'Built for Shopify' badged.
  • ◆Publisher domain shiprobot.com has an expired TLS certificate, indicating an unmaintained / abandoned operational posture.
  • ◆Server is nginx 1.10.1 on Play Framework (PLAY_SESSION cookie) - stack ~10 years old.

Top findingsview all

  • Critical
    Publisher website TLS certificate is expired
  • High
    Outdated nginx 1.10.1 web server (2016)
Synthesis

Analysis summary

Multi-carrier and Multi-channel Shipping Labels

Key insights
  • ◆Shipping/label app for Shopify by ShipRobot LLC (San Francisco, founded 2015).
  • ◆Rating 4.6 with only ~22 reviews; not 'Built for Shopify' badged.
  • ◆Publisher domain shiprobot.com has an expired TLS certificate, indicating an unmaintained / abandoned operational posture.
  • ◆Server is nginx 1.10.1 on Play Framework (PLAY_SESSION cookie) - stack ~10 years old.
  • ◆Privacy policy is not accessible over a valid TLS connection.
  • ◆No public CVE or breach record specifically attributable to ShipRobot LLC.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_orders
High

Shipping apps must read orders to fetch addresses, line items, and customer data. Includes PII.

write_orders
High

Required to mark orders fulfilled and update fulfillment status / tracking numbers.

read_customers
High

Needed to retrieve shipping addresses; exposes customer PII (name, address, phone, email).

read_products
Medium

Reads product/variant data (weights, dimensions) for label generation.

read_shipping
Medium

Reads shipping zones/rates to produce labels.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
shiprobot.com
TLS grade
F
HSTS
Missing
CSP
Missing

Expired TLS certificate at shiprobot.com (TLSv1.2 alert certificate_expired). Server header: nginx/1.10.1 (2016, EOL). No HSTS, no CSP. Play Framework session cookies present. Strongly suggests unmaintained infrastructure.

Posture

Compliance & certifications

GDPR webhooks Fail
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Fail

Privacy policy could not be retrieved because the publisher's TLS certificate is expired; no certifications could be verified.

Privacy policy
Track record

Publisher reputation

Publisher
ShipRobot LLC
Verified Shopify Partner
No
Years active
11
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.