starship / search / shipsell

Audit report

FREE Shipping calculator

Broad accessReach : moderateSensitive Access

by LaraLancer · Marketing · Shopify App Store

Marketing

Risk level

Broad access

Executive summary

FREE Shipping calculator - how much left to get FREE shipping

Key insights

◆Simple free-shipping progress bar widget by indie publisher LaraLancer.
◆Rating 4.8 across 36 reviews, small install base.
◆Requests view_staff_data (owner PII) plus edit_store_data (products/collections), broader than the widget's stated purpose.
◆Publisher infra runs aged nginx 1.14.0 on Ubuntu, served over plain HTTP for the privacy-policy origin.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

FREE Shipping calculator - how much left to get FREE shipping

Key insights

◆Simple free-shipping progress bar widget by indie publisher LaraLancer.
◆Rating 4.8 across 36 reviews, small install base.
◆Requests view_staff_data (owner PII) plus edit_store_data (products/collections), broader than the widget's stated purpose.
◆Publisher infra runs aged nginx 1.14.0 on Ubuntu, served over plain HTTP for the privacy-policy origin.
◆Privacy policy is a generic cookie-style notice naming ad/analytics trackers (Facebook, Google ads, Taboola) and lacks DPA/compliance language.
◆No publicly disclosed CVEs, breaches or security incidents tied to LaraLancer or this app.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

App requests write access to products and collections

Medium

The app declares 'edit_store_data' scope for products and collections, which is broader than necessary for a free shipping progress bar widget. Such a widget typically only needs theme extension capability, not write access to catalog data.

Evidence

https://apps.shopify.com/shipsell

Privacy policy missing HTTPS/HSTS hardening on publisher infrastructure

Medium

Publisher domain urgencer.laralancer.com responds over HTTP (no HTTPS redirect observed) with no HSTS header. Server runs nginx 1.14.0 on Ubuntu, an old release no longer receiving security updates. This is risky for any data flowing back to the publisher.

Evidence

https://urgencer.laralancer.com/

Privacy policy lists multiple ad/tracking sub-processors with no opt-out for merchant data

Medium

Privacy policy explicitly lists Facebook, Google Analytics, Google AdWords, Google AdMob, Google AdSense, YouTube, Google Maps and Taboola as sub-processors. No clear separation between website-visitor cookies and merchant-store data is provided.

Evidence

https://urgencer.laralancer.com/privacy-policy

No compliance certifications declared

Low

Privacy policy does not mention GDPR Article 28 DPA, CCPA, SOC2, ISO27001, PCI DSS or HIPAA. No data residency commitment to merchant data (only US storage of Google Analytics cookies).

Evidence

https://urgencer.laralancer.com/privacy-policy

App not 'Built for Shopify' certified

Low

App does not carry the Built for Shopify badge, indicating it has not passed Shopify's quality, security and performance review.

Evidence

https://apps.shopify.com/shipsell

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_users`	High	Reads store owner name, email, phone, physical address (staff/owner PII).
`write_products`	High	Edit access to products and collections, write scope is wider than required for a cart progress bar.

read_users

High

Reads store owner name, email, phone, physical address (staff/owner PII).

write_products

High

Edit access to products and collections, write scope is wider than required for a cart progress bar.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

urgencer.laralancer.com

unknown · Publisher backend / privacy-policy origin

Declared

google-analytics.com

US · Web analytics on publisher site

Declared

facebook.com

US · Ad pixel / tracking on publisher site

Declared

Sub-processors

FacebookGoogle AnalyticsGoogle AdWordsGoogle AdMobGoogle AdSenseYouTubeGoogle MapsTaboola

Data residency: US

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: urgencer.laralancer.com
TLS grade: C
HSTS: Missing
CSP: Missing

Publisher origin responded over HTTP via nginx 1.14.0 on Ubuntu (EOL); no HSTS, no CSP, no security headers observed.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Generic cookie-style policy; no DPA, no Article 28 / SCC language, no certifications declared.

Track record

Publisher reputation

Publisher: LaraLancer
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.