AI App Radar DACH: run 2026-Q4-recall
AI App Radar DACH
This page shows the numbers of exactly this run. It does not change when new runs are added — this is the address to cite.
n = 3,728 discoverable AI apps with a DACH connection · run 2026-Q4-recall · closed on 8 November 2026
99% of the 3,734 scheduled targets were reachable; only reachable apps count.
The check in a real browser ran for 88% of the apps. Findings that are only visible there count over those apps only.
1%
17 apps
81%
3,027 apps
18%
684 apps
What stands out
The most common findings in the sample. The share says how many apps triggered the rule — counted only over the apps where the rule could check at all. It does not say whether the finding holds in any individual case.
Defects
Findings of medium severity and above that describe an observed state — a readable table, a tracker before consent, user input rendered unfiltered. They decide the verdict.
- Medium — SeverityRSC-ACC-004Accessibility violations in the rendered state75%
- Medium — SeverityRSC-ARC-005Non-existent paths answer with 20056%
- Medium — SeverityRSC-PRV-001Google Fonts loaded at runtime46%
- Medium — SeverityRSC-SEC-035Browser writes directly to the database34%
- Medium — SeverityRSC-ARC-001Content rendered client-side only26%
- Medium — SeverityRSC-SCL-007Heavy first page load23%
- Medium — SeverityRSC-PRV-017Service not named in the privacy policy22%
- Medium — SeverityRSC-PRV-006Data sent to third-country services18%
- Medium — SeverityRSC-PRV-007Trackers without a consent layer17%
- High — SeverityRSC-PRV-005Trackers fire before consent13%
- Medium — SeverityRSC-SCL-001Queries without a limit12%
- High — SeverityRSC-PRV-003Mandatory legal pages not visible11%
- Medium — SeverityRSC-SCL-002Very large JavaScript bundle11%
- High — SeverityRSC-PRV-008Tracking cookies set before consent7%
- High — SeverityRSC-SEC-078Shipped library with a known vulnerability6%
Hardening and hygiene
Missing protective layers and hygiene — a header, a DNS record. They show up on almost every site because hardly anyone sets them, and they never tip a verdict. Prevalence is not severity.
- Low — SeverityRSC-SEC-092No CAA record99%
- Medium — SeverityRSC-SEC-003No Content-Security-Policy98%
- Low — SeverityRSC-SCL-004No caching strategy93%
- Low — SeverityRSC-SEC-005No clickjacking protection90%
- Low — SeverityRSC-ARC-004No canonical link50%
- Low — SeverityRSC-SEC-087DMARC with `p=none`43%
- Low — SeverityRSC-SEC-093No security.txt — no contact for vulnerability reports43%
- Low — SeverityRSC-PRV-022Contact data in the shipped JavaScript36%
- Low — SeverityRSC-PRV-002US trackers embedded in the shipped code20%
- Low — SeverityRSC-SCL-003Images without optimisation16%
- Low — SeverityRSC-PRV-012Privacy policy: mandatory details not found15%
- Medium — SeverityRSC-SEC-085No DMARC record14%
- Low — SeverityRSC-ARC-006No robots.txt and no sitemap13%
- Low — SeverityRSC-PRV-011Imprint: mandatory details not found13%
- Medium — SeverityRSC-SEC-084No SPF and no DMARC — email spoofing unprotected11%
By platform
| Platform | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Lovable | 3,030 | 1% | 81% | 18% |
| Base44 | 383 | 2% | 79% | 19% |
| No builder detected | 129 | 2% | 74% | 24% |
| Bolt | 107 | 0% | 79% | 21% |
| Wix | 49 | 0% | 100% | 0% |
By jurisdiction
| Jurisdiction | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Germany | 2,190 | 1% | 80% | 20% |
| Switzerland | 1,307 | 1% | 84% | 15% |
Groups with fewer than 20 apps are not shown — not as “0%”, but not at all. From that few rows a single app could be picked out.
How to cite
Numbers and JSON are available under CC-BY 4.0. Please cite as “decivo AI App Radar DACH” with a link. Raw numbers as JSON
How the sample is built, what the scan loads and what it never does, and how to remove your domain: Radar methodology