AI App Radar DACH: run Panel 2026-10-01
AI App Radar DACH
This page shows the numbers of exactly this run. It does not change when new runs are added — this is the address to cite.
n = 454 discoverable AI apps with a DACH connection · run Panel 2026-10-01 · closed on 2 October 2026
99% of the 455 scheduled targets were reachable; only reachable apps count.
The check in a real browser ran for 86% of the apps. Findings that are only visible there count over those apps only.
1%
4 apps
81%
367 apps
18%
83 apps
What stands out
The most common findings in the sample. The share says how many apps triggered the rule — counted only over the apps where the rule could check at all. It does not say whether the finding holds in any individual case.
Defects
Findings of medium severity and above that describe an observed state — a readable table, a tracker before consent, user input rendered unfiltered. They decide the verdict.
- Medium — SeverityRSC-ACC-004Accessibility violations in the rendered state76%
- Medium — SeverityRSC-ARC-005Non-existent paths answer with 20072%
- Medium — SeverityRSC-PRV-001Google Fonts loaded at runtime36%
- Medium — SeverityRSC-PRV-006Data sent to third-country services33%
- Medium — SeverityRSC-SCL-007Heavy first page load25%
- Medium — SeverityRSC-ARC-001Content rendered client-side only25%
- Medium — SeverityRSC-SEC-035Browser writes directly to the database24%
- Medium — SeverityRSC-PRV-007Trackers without a consent layer17%
- Medium — SeverityRSC-PRV-017Service not named in the privacy policy16%
- High — SeverityRSC-PRV-003Mandatory legal pages not visible16%
- High — SeverityRSC-PRV-005Trackers fire before consent15%
- Medium — SeverityRSC-SCL-002Very large JavaScript bundle14%
- Medium — SeverityRSC-SEC-019Role check inside the client bundle13%
- High — SeverityRSC-PRV-008Tracking cookies set before consent12%
- High — SeverityRSC-SEC-078Shipped library with a known vulnerability8%
Hardening and hygiene
Missing protective layers and hygiene — a header, a DNS record. They show up on almost every site because hardly anyone sets them, and they never tip a verdict. Prevalence is not severity.
- Low — SeverityRSC-SEC-092No CAA record99%
- Medium — SeverityRSC-SEC-003No Content-Security-Policy98%
- Low — SeverityRSC-SEC-005No clickjacking protection90%
- Low — SeverityRSC-SCL-004No caching strategy64%
- Low — SeverityRSC-ARC-004No canonical link46%
- Low — SeverityRSC-SEC-087DMARC with `p=none`38%
- Low — SeverityRSC-PRV-022Contact data in the shipped JavaScript33%
- Low — SeverityRSC-SEC-004MIME sniffing not disabled32%
- Low — SeverityRSC-SEC-024No Referrer-Policy32%
- Low — SeverityRSC-SEC-093No security.txt — no contact for vulnerability reports26%
- Low — SeverityRSC-ARC-006No robots.txt and no sitemap23%
- Low — SeverityRSC-PRV-002US trackers embedded in the shipped code16%
- Low — SeverityRSC-PRV-012Privacy policy: mandatory details not found14%
- Medium — SeverityRSC-SEC-084No SPF and no DMARC — email spoofing unprotected14%
- Low — SeverityRSC-PRV-011Imprint: mandatory details not found13%
By platform
| Platform | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Lovable | 187 | 0% | 75% | 25% |
| Base44 | 122 | 2% | 87% | 11% |
| Bolt | 110 | 0% | 84% | 16% |
By jurisdiction
| Jurisdiction | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Germany | 172 | 0% | 77% | 23% |
| Switzerland | 204 | 1% | 87% | 12% |
Groups with fewer than 20 apps are not shown — not as “0%”, but not at all. From that few rows a single app could be picked out.
How to cite
Numbers and JSON are available under CC-BY 4.0. Please cite as “decivo AI App Radar DACH” with a link. Raw numbers as JSON
How the sample is built, what the scan loads and what it never does, and how to remove your domain: Radar methodology