Skip to content

AI App Radar DACH: run DACH 2026-09 Lauf 3

AI App Radar DACH

This page shows the numbers of exactly this run. It does not change when new runs are added — this is the address to cite.

n = 78 discoverable AI apps with a DACH connection · run DACH 2026-09 Lauf 3 · closed on 4 September 2026

100% of the 78 scheduled targets were reachable; only reachable apps count.

The check in a real browser ran for 88% of the apps. Findings that are only visible there count over those apps only.

Stop

0%

0 apps

Iterate

77%

60 apps

Go

23%

18 apps

What stands out

The most common findings in the sample. The share says how many apps triggered the rule — counted only over the apps where the rule could check at all. It does not say whether the finding holds in any individual case.

Defects

Findings of medium severity and above that describe an observed state — a readable table, a tracker before consent, user input rendered unfiltered. They decide the verdict.

  • Medium — SeverityRSC-ACC-004Accessibility violations in the rendered stateof 69 apps where the check could run74%
  • Medium — SeverityRSC-ARC-005Non-existent paths answer with 20063%
  • Medium — SeverityRSC-PRV-001Google Fonts loaded at runtime33%
  • Medium — SeverityRSC-PRV-006Data sent to third-country servicesof 69 apps where the check could run25%
  • Medium — SeverityRSC-SCL-007Heavy first page loadof 69 apps where the check could run20%
  • Medium — SeverityRSC-SEC-008Cookies without Secure/HttpOnly19%
  • Medium — SeverityRSC-PRV-007Trackers without a consent layer17%
  • Medium — SeverityRSC-ARC-001Content rendered client-side only13%
  • High — SeverityRSC-SEC-018Protected area guarded only in the browser13%
  • Medium — SeverityRSC-SEC-035Browser writes directly to the database13%
  • Medium — SeverityRSC-PRV-017Service not named in the privacy policy10%
  • Medium — SeverityRSC-SCL-002Very large JavaScript bundle8%
  • Medium — SeverityRSC-PRV-009Third-party cookies set before consentof 69 apps where the check could run7%
  • High — SeverityRSC-PRV-005Trackers fire before consentof 69 apps where the check could run6%
  • High — SeverityRSC-PRV-008Tracking cookies set before consentof 69 apps where the check could run6%

Hardening and hygiene

Missing protective layers and hygiene — a header, a DNS record. They show up on almost every site because hardly anyone sets them, and they never tip a verdict. Prevalence is not severity.

  • Medium — SeverityRSC-SEC-003No Content-Security-Policy90%
  • Low — SeverityRSC-SCL-004No caching strategy87%
  • Low — SeverityRSC-SEC-005No clickjacking protection87%
  • Low — SeverityRSC-PRV-022Contact data in the shipped JavaScript64%
  • Low — SeverityRSC-ARC-004No canonical link49%
  • Low — SeverityRSC-SEC-093No security.txt — no contact for vulnerability reports27%
  • Low — SeverityRSC-ARC-006No robots.txt and no sitemap23%
  • Low — SeverityRSC-PRV-002US trackers embedded in the shipped code12%
  • Low — SeverityRSC-SCL-003Images without optimisation10%
  • Low — SeverityRSC-SEC-004MIME sniffing not disabled10%
  • Low — SeverityRSC-SEC-024No Referrer-Policy9%
  • Low — SeverityRSC-SEC-092No CAA record9%
  • Low — SeverityRSC-COD-001Source maps public8%
  • Low — SeverityRSC-PRV-012Privacy policy: mandatory details not found8%
  • Low — SeverityRSC-PRV-011Imprint: mandatory details not found5%

By platform

PlatformStopIterateGo
Lovable43 apps0%67%33%

By jurisdiction

Groups with fewer than 20 apps are not shown — not as “0%”, but not at all. From that few rows a single app could be picked out.

How to cite

decivo AI App Radar DACH, run DACH 2026-09 Lauf 3, methodology 2026.15, decivo.de/en/scan/radar/lauf/dach-2026-09-lauf-3

Numbers and JSON are available under CC-BY 4.0. Please cite as “decivo AI App Radar DACH” with a link. Raw numbers as JSON

How the sample is built, what the scan loads and what it never does, and how to remove your domain: Radar methodology

Scan your own app for freeAI App Radar DACH