AI App Radar DACH: run DACH 2026-09 Lauf 7
AI App Radar DACH
This page shows the numbers of exactly this run. It does not change when new runs are added — this is the address to cite.
n = 478 discoverable AI apps with a DACH connection · run DACH 2026-09 Lauf 7 · closed on 8 September 2026
99% of the 484 scheduled targets were reachable; only reachable apps count.
The check in a real browser ran for 87% of the apps. Findings that are only visible there count over those apps only.
1%
2 apps
86%
412 apps
13%
64 apps
What stands out
The most common findings in the sample. The share says how many apps triggered the rule — counted only over the apps where the rule could check at all. It does not say whether the finding holds in any individual case.
Defects
Findings of medium severity and above that describe an observed state — a readable table, a tracker before consent, user input rendered unfiltered. They decide the verdict.
- Medium — SeverityRSC-ACC-004Accessibility violations in the rendered state75%
- Medium — SeverityRSC-ARC-005Non-existent paths answer with 20071%
- Medium — SeverityRSC-PRV-001Google Fonts loaded at runtime37%
- Medium — SeverityRSC-PRV-006Data sent to third-country services33%
- Medium — SeverityRSC-SCL-007Heavy first page load25%
- Medium — SeverityRSC-ARC-001Content rendered client-side only24%
- Medium — SeverityRSC-SEC-035Browser writes directly to the database24%
- Medium — SeverityRSC-PRV-007Trackers without a consent layer17%
- High — SeverityRSC-PRV-003Mandatory legal pages not visible17%
- Medium — SeverityRSC-PRV-017Service not named in the privacy policy16%
- Medium — SeverityRSC-SCL-002Very large JavaScript bundle13%
- Medium — SeverityRSC-SEC-019Role check inside the client bundle12%
- High — SeverityRSC-PRV-005Trackers fire before consent12%
- High — SeverityRSC-PRV-008Tracking cookies set before consent11%
- Medium — SeverityRSC-PRV-009Third-party cookies set before consent8%
Hardening and hygiene
Missing protective layers and hygiene — a header, a DNS record. They show up on almost every site because hardly anyone sets them, and they never tip a verdict. Prevalence is not severity.
- Low — SeverityRSC-SEC-092No CAA record99%
- Medium — SeverityRSC-SEC-003No Content-Security-Policy97%
- Low — SeverityRSC-SEC-005No clickjacking protection90%
- Low — SeverityRSC-SCL-004No caching strategy63%
- Low — SeverityRSC-ARC-004No canonical link45%
- Low — SeverityRSC-SEC-087DMARC with `p=none`38%
- Low — SeverityRSC-SEC-024No Referrer-Policy33%
- Low — SeverityRSC-SEC-004MIME sniffing not disabled32%
- Low — SeverityRSC-PRV-022Contact data in the shipped JavaScript32%
- Low — SeverityRSC-SEC-093No security.txt — no contact for vulnerability reports26%
- Low — SeverityRSC-ARC-006No robots.txt and no sitemap24%
- Low — SeverityRSC-PRV-012Privacy policy: mandatory details not found16%
- Low — SeverityRSC-PRV-002US trackers embedded in the shipped code15%
- Low — SeverityRSC-PRV-011Imprint: mandatory details not found15%
- Medium — SeverityRSC-SEC-084No SPF and no DMARC — email spoofing unprotected12%
By platform
| Platform | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Lovable | 189 | 0% | 81% | 19% |
| Base44 | 133 | 0% | 92% | 8% |
| Bolt | 123 | 1% | 90% | 9% |
By jurisdiction
| Jurisdiction | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Germany | 185 | 0% | 83% | 17% |
| Switzerland | 212 | 1% | 91% | 8% |
Groups with fewer than 20 apps are not shown — not as “0%”, but not at all. From that few rows a single app could be picked out.
How to cite
Numbers and JSON are available under CC-BY 4.0. Please cite as “decivo AI App Radar DACH” with a link. Raw numbers as JSON
How the sample is built, what the scan loads and what it never does, and how to remove your domain: Radar methodology