Skip to content

AI App Radar DACH: run DACH 2026-09 Lauf 4

AI App Radar DACH

This page shows the numbers of exactly this run. It does not change when new runs are added — this is the address to cite.

n = 118 discoverable AI apps with a DACH connection · run DACH 2026-09 Lauf 4 · closed on 4 September 2026

100% of the 118 scheduled targets were reachable; only reachable apps count.

The check in a real browser ran for 87% of the apps. Findings that are only visible there count over those apps only.

Stop

0%

0 apps

Iterate

73%

86 apps

Go

27%

32 apps

What stands out

The most common findings in the sample. The share says how many apps triggered the rule — counted only over the apps where the rule could check at all. It does not say whether the finding holds in any individual case.

Defects

Findings of medium severity and above that describe an observed state — a readable table, a tracker before consent, user input rendered unfiltered. They decide the verdict.

  • Medium — SeverityRSC-ACC-004Accessibility violations in the rendered stateof 103 apps where the check could run75%
  • Medium — SeverityRSC-ARC-005Non-existent paths answer with 20067%
  • Medium — SeverityRSC-PRV-001Google Fonts loaded at runtime34%
  • Medium — SeverityRSC-PRV-006Data sent to third-country servicesof 103 apps where the check could run27%
  • Medium — SeverityRSC-SCL-007Heavy first page loadof 103 apps where the check could run23%
  • Medium — SeverityRSC-PRV-007Trackers without a consent layer19%
  • Medium — SeverityRSC-ARC-001Content rendered client-side only14%
  • Medium — SeverityRSC-SEC-035Browser writes directly to the database13%
  • Medium — SeverityRSC-SEC-008Cookies without Secure/HttpOnly10%
  • High — SeverityRSC-SEC-018Protected area guarded only in the browser9%
  • Medium — SeverityRSC-SEC-019Role check inside the client bundle9%
  • Medium — SeverityRSC-SCL-002Very large JavaScript bundle8%
  • High — SeverityRSC-PRV-005Trackers fire before consentof 103 apps where the check could run8%
  • High — SeverityRSC-PRV-008Tracking cookies set before consentof 103 apps where the check could run8%
  • Medium — SeverityRSC-PRV-009Third-party cookies set before consentof 103 apps where the check could run8%

Hardening and hygiene

Missing protective layers and hygiene — a header, a DNS record. They show up on almost every site because hardly anyone sets them, and they never tip a verdict. Prevalence is not severity.

  • Medium — SeverityRSC-SEC-003No Content-Security-Policy97%
  • Low — SeverityRSC-SCL-004No caching strategy91%
  • Low — SeverityRSC-SEC-005No clickjacking protection88%
  • Low — SeverityRSC-ARC-004No canonical link44%
  • Low — SeverityRSC-PRV-022Contact data in the shipped JavaScript32%
  • Low — SeverityRSC-SEC-093No security.txt — no contact for vulnerability reports30%
  • Low — SeverityRSC-ARC-006No robots.txt and no sitemap24%
  • Low — SeverityRSC-PRV-002US trackers embedded in the shipped code11%
  • Low — SeverityRSC-COD-001Source maps public10%
  • Low — SeverityRSC-SCL-003Images without optimisation8%
  • Low — SeverityRSC-SEC-004MIME sniffing not disabled8%
  • Low — SeverityRSC-SEC-024No Referrer-Policy7%
  • Low — SeverityRSC-PRV-014Tracking cookie with a very long lifetimeof 103 apps where the check could run6%
  • Low — SeverityRSC-PRV-012Privacy policy: mandatory details not found5%
  • Low — SeverityRSC-PRV-011Imprint: mandatory details not found4%

By platform

PlatformStopIterateGo
Lovable66 apps0%61%39%

By jurisdiction

Groups with fewer than 20 apps are not shown — not as “0%”, but not at all. From that few rows a single app could be picked out.

How to cite

decivo AI App Radar DACH, run DACH 2026-09 Lauf 4, methodology 2026.16, decivo.de/en/scan/radar/lauf/dach-2026-09-lauf-4

Numbers and JSON are available under CC-BY 4.0. Please cite as “decivo AI App Radar DACH” with a link. Raw numbers as JSON

How the sample is built, what the scan loads and what it never does, and how to remove your domain: Radar methodology

Scan your own app for freeAI App Radar DACH