优化
-
按评分
Probably worth mentioning this.
We had this app on our shopify store and because no customer used it due to our site having lower priced items we uninstalled the app.
After uninstalling it though we had a weird incident where a bot in the middle of the night used our website to add 1.00 shipinsure to dozens and dozens of carts using different people's stolen credit cards.
They managed to check out with a couple purchases and bought 1.00 worth of ship insure insurance. This was immediately fulfilled by the app/store automatically, even after we had unistalled this app.
It's resulted in chargebacks from the customers banks who's credit cards were stolen and used to make purchases on our store.
We are lucky that only 2 purchases were made because each charge back is the amount plus 15 dollars. It could have been way worse.
We see the shipinsure items were hidden on our store, uninstalled but still left in a collection. This allowed bots on google to find them as listings and automatically test those stolen credit cards and cause problems for those poor people who's cards were stolen and screw us with bank chargebacks as they do their investigation.
It could have been way worse but there are clearly some vulnerabilities in this app that might put a shopify store at risk. Just wanted to mention this incident! Hope it can be resolved or figured out.