allbirds.com

Results Summary

34 findings detected across allbirds.com.

Severity Breakdown

Total findings detected across all components. The public summary below groups findings by vulnerability type. To see every affected component in full detail, run a free scan on your own domain at vulnify.app/tools.

Findings Overview

32 unique issues shown below, grouped from 34 total findings. When a vulnerability affects multiple components, it is listed once with the affected component count.

• high High third-party domain sprawl detected across sampled storefront routes

  Detected 31 distinct third-party host(s) across sampled routes: allbirds.at, allbirds.ch, allbirds.com.my, allbirds.com.ph, allbirds.com.pl, allbirds.com.sg, allbirds.cz, allbirds.de, allbirds.fr, allbirds.it, allbirds.li, allbirds.mt, allbirds.sm, a…

• high CSP missing default-src directive

  Missing default-src weakens baseline fallback behavior.

• high Cookie missing Secure flag

  Affects 2 components

  localization: localization=US; path=/; expires=Mon, 18 Oct 2027 10:50:06 GMT; SameSite=Lax

• medium Referrer-Policy: missing

  Controls how much referrer information is shared

• medium Permissions-Policy: missing

  Controls browser features and APIs

• medium CSP missing object-src restriction

  Object/embed content is not explicitly restricted.

• medium Cookie missing HttpOnly flag

  Affects 2 components

  localization: localization=US; path=/; expires=Mon, 18 Oct 2027 10:50:06 GMT; SameSite=Lax

• medium HTTP resources detected on page

  Found 1 HTTP resource reference(s). Active=0, passive=0.

• medium Disclosure headers or generator metadata expose stack details

  Server: cloudflare

• medium Technology fingerprint signals were detected across the public surface

  Shopify on /, /products/mens-runner-nz-slip-on-mushroom, /products/mens-cruiser-medium-grey, /products/mens-tree-runner-nz-medium-grey, /products/[REDACTED] | Vue on /, /products/mens-runner-nz-slip-on-mushroom, /products/mens-cruiser-medium-grey, /p…

• medium Library exposure was confirmed across multiple sampled routes

  Vue on /, /products/mens-runner-nz-slip-on-mushroom, /products/mens-cruiser-medium-grey, /products/mens-tree-runner-nz-medium-grey, /products/[REDACTED] | Swiper on /, /products/mens-runner-nz-slip-on-mushroom, /products/mens-cruiser-medium-grey, /pr…

• low No obvious storefront JSON endpoint references found in initial HTML

  This can be normal for certain themes, but verify app/theme data endpoints stay limited to required public storefront usage.

• low Shopify app footprint signals detected

  Detected 2 app-related asset signal(s). Review installed app governance and remove unused integrations.

• info Shopify storefront signals detected

  Signal count: 6. Ensure the target is the live Shopify storefront domain.

• info Third-party script footprint appears manageable

  Third-party scripts: 2; Shopify CDN scripts: 4.

• info Broader Shopify route coverage completed

  Sampled 12 storefront route(s) plus public JSON/account endpoints for deeper evidence.

• info Public Shopify JSON storefront surfaces responded during validation

  /cart.js (200), /products.json (200), /search/suggest.json (200). Public products on the first page: at least 50. Predictive search results observed: 0.

• info Public product and collection titles were readable

  Public products on the first page: at least 50. Collections on the first page: at least 50. Sample: Product: Women's Allbirds Flip Flop - Dusty Pink; Product: Men's Canvas Runner NZ - Deep Navy Stripes (Blizzard Sole); Product: Women's Canvas Runner …

• info TLS grade: A+

  Protocol: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 (TLSv1.3)

• info Strict-Transport-Security (HSTS): present

  max-age=7889238

What the Shopify Storefront Check Covers

This security profile for allbirds.com was generated by Vulnify. The check analyzes:

• Storefront theme and app detection
• JavaScript and asset security review
• Security headers and CSP assessment
• Third-party script and integration checks

Prioritized Actions

• highReduce cross-route third-party storefront dependencies
• highSet default-src baseline
• highHarden cookies
• highMigrate asset links to HTTPS
• mediumAudit Shopify app footprint and ownership
• mediumAdd Referrer-Policy header
• mediumAdd Permissions-Policy header
• mediumDisable object/embed execution
• mediumUse hardened cookie prefixes where possible
• mediumReduce disclosure headers
• lowImprove Content-Security-Policy (CSP) configuration
• lowImprove Strict-Transport-Security (HSTS) configuration
• lowMinimize unnecessary version or generator disclosure

About This Check

This report was generated using Vulnify's free security tools. Results reflect the configuration at the time of the check. For ongoing monitoring, detailed remediation guidance, and vulnerability scanning across 50+ security tests, create a free Vulnify account.

Last checked: October 18, 2026