starship / search / shopify-latest-tweet

Audit report

Latest Tweet By Webkul

Broad accessReach : broad

by Webkul Software Pvt Ltd · Sales and conversion optimization · Shopify App Store

Sales and conversion optimization

Risk level

Broad access

Executive summary

Display your latest tweets at your Store Front

Key insights

◆Narrow-utility tweet widget app from a large India-based publisher (Webkul) that ships hundreds of Shopify and ecommerce apps.
◆Requests staff PII (owner name/email/phone/address) plus theme write access, broader than strictly necessary for a static tweet block.
◆No 'Built for Shopify' badge, no reviews since 2015 listing, low adoption, limited community signal.
◆Publisher portfolio has multiple 2026 CVEs (RCE/SSTI/auth-bypass) in Bagisto and Krayin CRM products, secure-SDLC concern, though not directly in this app.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Display your latest tweets at your Store Front

Key insights

◆Narrow-utility tweet widget app from a large India-based publisher (Webkul) that ships hundreds of Shopify and ecommerce apps.
◆Requests staff PII (owner name/email/phone/address) plus theme write access, broader than strictly necessary for a static tweet block.
◆No 'Built for Shopify' badge, no reviews since 2015 listing, low adoption, limited community signal.
◆Publisher portfolio has multiple 2026 CVEs (RCE/SSTI/auth-bypass) in Bagisto and Krayin CRM products, secure-SDLC concern, though not directly in this app.
◆Privacy policy is generic, omits data residency, retention timelines, sub-processors, and any compliance certification.

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

Theme editing scope (write_themes) without strong justification

Medium

App requests theme editing capability (script tags and theme editor write access) to inject a tweet widget. Write access to themes is a sensitive scope that allows persistent code injection into the storefront, which could be abused if the publisher is compromised. The app's narrow utility (display latest tweets) could reasonably be achieved with a theme app extension block.

Evidence

https://apps.shopify.com/shopify-latest-tweet

Publisher has multiple authenticated RCE/XSS CVEs in adjacent products (Krayin CRM, Bagisto)

Medium

Webkul's other open-source products (Krayin CRM v2.2.x, Bagisto) have several recently disclosed authenticated RCE, SSTI, SSRF, auth-bypass and XSS vulnerabilities (e.g., CVE-2026-38526, CVE-2026-38529, CVE-2026-21448, CVE-2026-21450, CVE-2026-36341). While these do not directly affect the Shopify app, they indicate a weaker secure-SDLC posture across the publisher's portfolio.

Evidence

https://www.cvedetails.com/vendor/10793/Webkul.html

Privacy policy lacks data residency, retention timelines, and sub-processor list

Low

Webkul's privacy policy does not specify where personal data is stored, does not define retention timelines for most data categories, and provides no enumerated sub-processor list or compliance certifications (SOC2/ISO27001/GDPR DPA reference).

Evidence

https://webkul.com/privacy-policy/

Publisher website lacks a real Content Security Policy

Low

webkul.com sends only `Content-Security-Policy: upgrade-insecure-requests`, which is not a substantive CSP. HSTS max-age is also short (~30 days). This is the publisher's marketing site, not the app surface, but reflects general security hygiene.

Evidence

https://webkul.com/

Zero reviews after >10 years on the Shopify App Store

Info

App listed since March 2015 with 0 reviews and no 'Built for Shopify' badge. Suggests low real-world usage and limited public scrutiny of the integration.

Evidence

https://apps.shopify.com/shopify-latest-tweet

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_staff_information`	Medium	Access to store owner name, email, phone, and physical address is PII; not needed to render tweets.
`write_script_tags`	High	Script tags inject JavaScript into the storefront on every page load; if the publisher is compromised, this becomes a Magecart-style attack surface.
`write_themes`	High	Theme editing allows persistent modification of storefront templates; high blast radius if abused.

read_staff_information

Medium

Access to store owner name, email, phone, and physical address is PII; not needed to render tweets.

write_script_tags

High

Script tags inject JavaScript into the storefront on every page load; if the publisher is compromised, this becomes a Magecart-style attack surface.

write_themes

High

Theme editing allows persistent modification of storefront templates; high blast radius if abused.

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: webkul.com
TLS grade: unknown
HSTS: Enabled
CSP: Missing

Cloudflare-fronted WordPress site. HSTS present (max-age 2,592,000 ~ 30 days, includeSubDomains, no preload). Only `Content-Security-Policy: upgrade-insecure-requests` set, which is not a real CSP. X-Content-Type-Options, X-Frame-Options=SAMEORIGIN, X-XSS-Protection present.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

No explicit certifications referenced in privacy policy; no GDPR DPA link, no SOC2/ISO27001/PCI claims. Policy mentions third-party processors generically without naming them.

Track record

Publisher reputation

Publisher: Webkul Software Pvt Ltd
Verified Shopify Partner: No
Years active: 11
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

Latest Tweet By Webkul

Key insights

Top findings

Analysis summary

Findings (5)

Theme editing scope (write_themes) without strong justification

Publisher has multiple authenticated RCE/XSS CVEs in adjacent products (Krayin CRM, Bagisto)

Privacy policy lacks data residency, retention timelines, and sub-processor list

Publisher website lacks a real Content Security Policy

Zero reviews after >10 years on the Shopify App Store

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage