Amazon Shopper Panel app for iOS: Broken FAQ Link and S3 Bucket 403 Error

 iOS 26.3.1

Amazon Shopper Panel app for iOS (version 5.1.6)

03/11/2026

Description: 

There is a "Program FAQs" link inside of the Amazon Shopper Panel app for iOS that leads to an access denied page. 

I first at thought that this error message was based on my location - however after running the same URL through a US proxy, I see that this is likely a dead link pointing to an incorrect location. 

Archived Link: https://archive.is/H8iHK

Steps to Reproduce:

1. Download and launch the Amazon Shopper Panel for iOS

2. From the "Join the panel and earn rewards" page, select "Continue"

3. Advance (Continue > Continue > Get Started) to Amazon sign-in page 

4. Select the "Amazon Shopper Panel Program Terms and Conditions" link 

5. Scroll down and select "Program FAQs"

Result: the "Program FAQs" link on the "Amazon Shopper Panel Program Terms and Conditions" page accessible via the iOS app lead to an "access denied" error message 

Expected: A "Program FAQs" link should never lead to an access denied error message 

Download and launch the Amazon Shopper Panel app for iOS...

Select the "Amazon Shopper Panel Program Terms and Conditions" link...

Select the "Program FAQs" link...

User is taken here: https://d3smi4el0k163n.cloudfront.net/3.3.0/legal/faq/en-US/v1/rewards/FAQRewards-en-US-dev.html

Probably should have been this (?):  https://panel.amazon.com/FAQPrivacy.html

I sent the following message into Amazon: 

Dear Amazon Support Team,

I am writing to report a broken resource link within the Amazon Shopper Panel iOS application that appears to point to an internal development or staging environment.

Issue Description: In the "More" or "Help" section of the app, the link for the program FAQ is currently pointing to a URL that returns an XML "Access Denied" error from an S3 bucket via CloudFront.

Technical Details:

• Target URL: https://d3smi4el0k163n.cloudfront.net/3.3.0/legal/faq/en-US/v1/rewards/FAQRewards-en-US-dev.html

• Observed Behavior: The server returns an HTTP 403 (Forbidden) with an S3 <Code>AccessDenied</Code> XML response.

• Analysis: The presence of -dev.html in the filename suggests a hardcoded link to a development asset that is not permissioned for public access or has been removed. This occurs regardless of the requester's geographic location (verified via US-based proxies).

Impact: Users are unable to access the rewards FAQ from within the app, leading to a degraded user experience. While this does not appear to be a high-risk security leak, the raw XML response indicates a minor configuration drift between the production app and the storage bucket permissions.

I recommend updating the app to point to the production FAQ (e.g., https://panel.amazon.com/FAQPrivacy.html) and ensuring that CloudFront is configured to serve a standard 404 page rather than raw S3 XML for missing or private objects.

Best regards,

Robert Delaware

AWS Events app for iOS: Cookie Preferences link is dead

 iOS 18.1.1

AWS Events app for iOS (version 7.6.0)

11/27/2024

Description:

Here's an unusual problem: the AWS Events app has a "Cookie preferences" link. Nothing happens when this link is selected. The other links on this page ("Privacy Policy" and a "Site terms" links) take the user to expected pages. 

The "Cookie preferences" link does nothing. 

Here's what it looks like inside of the iOS app:

Here's what it looks like when that login page (https://registration.awsevents.com/flow/awsevents/reinvent24/reg/login) is accessed on a laptop:

The "Customize cookie preferences" page appears, along with a link to the AWS Cookie notice. 

Other Amazon produced apps have cookie preference pages that are accessible via in-app options. Presumably the AWS Events app should have this option for GDPR compliance? 

Steps to Reproduce: 

1. Download and launch the AWS Events app for iOS (version 7.6.0)

2. From the "All events" page, select "AWS re:Invent 2024"

3. From the "Sign In" page, scroll down and select "Cookie Preferences"

Result: The "Cookie preferences" link on the AWS Events login page inside of the AWS Events app is inactive - no cookies pop-up is activated 

Expected: There should not be a dead link inside of an Amazon released iOS app 

Please Note: The same problem occurs with AWS Events app for Android (version 7.6.0)

Download and launch the AWS Events app for iOS...

Select the "AWS re:Invent 2024" option...

Scroll down to the bottom of this login screen...

Select the "Cookie preferences" option: Nothing happens! 

Amazon Shopping app for iOS: Non functioning Location Services prompt violates Human Interface Guidelines

 Amazon Shopping app for iOS (version 19.1.0)

iOS 15.2 

Date: 01/09/2022

Description:

NOTE: This is not being written about functionality. This is about adherence to Apple's Human Interface Guidelines. This problem should have, presumably, prevented this app from making it through the App Store Review process...

The Amazon app for iPhone has an unusual option labeled "Enable Location Services" buried in the app's user interface in an area listed as "Legal & About"

This "Enable Location Services" option looks like this:

This option does NOT enable the location services with the app. This sure seems to be a violation of the Human Interface Guidelines which state that "imperative sentences" that do not "provide justification" are not allowed to be used as prompts to enable location services:

See this portion of the Human Interface Guidelines:

This portion of the Human Interface Guidelines states that "An imperative sentence that doesn't provide any justification." is not allowed. 

I've gotten this to reproduce with multiple iPhone devices. The exact same issue does NOT reproduce with Android. There is the same screen with Android, but no option to select "Enable Location Services" - I believe that this button was meant to lead to legal text. 

Steps to Reproduce:

1. On an iOS device running iOS 15.2, download and launch the Amazon Shopping app

2. Select the triple slider in the bottom right of the screen

3. Select "Settings" 

4. Select "Legal & About"

5. From the Amazon App for iPhone page, select the "Enable Location Services" option 

6. Note that the "Enable Location Services" option disappears after it is selected 

Result: There is an option in the Amazon Shopping app for iOS user interface labeled "Enable Location Services" - selecting this option does NOT enable location services for the Amazon Shopping app. 

Expected: There should not be a button simply labeled "Enable Location Services" as this does not provide "justification" for granting location access to the Amazon Shopping app

Download and launch the Amazon Shopping app for iOS...

Select the "Legal & About" option...

There's an "Enable Location Services" button. Selecting this button results in the option disappearing. 

Amazon app for iOS: Dead link on Mattress Recycling Fees

iOS 13.6
Amazon app for iOS (15.16.0)
Date: 08/20/20

Description:

Minor problem with an external link that is displayed in the help section of the Amazon app for iOS.

There is an external link to the Mattress Recycling Council website inside of a help section in the Amazon app for iOS.

This link does not work. The website doesn't load. Curiously mobile safari has no problem opening the site. And Amazon's website has a working link to it:

https://www.amazon.com/gp/help/customer/display.html?nodeId=202074570

Not sure why it is not working with the iOS app - but it probably should.


Steps to Reproduce:

1. Launch the app
2. Sign into account
3. Select the side bar menu in upper left
4. Select "Customer Service" at the bottom
5. In the "Need More Help?" box, enter "mattress"
6. Select the "Mattress Recycling Fees" option
7. Select the https://mattressrecyclingcouncil.org/ link

Result: There is a non-working link inside of the Amazon iOS app on the Mattress Recycling Fees page

Expected: If there is an external link inside of the Amazon iOS app, it should work

Enter in "Mattresses" inside of this input box...

Select the "Mattress Recycling Fees" option...

From this "Mattress Recycling Fees" page, click on the link...

This website doesn't seem to load.