AI App Radar DACH: run Panel 2026-10-22
AI App Radar DACH
This page shows the numbers of exactly this run. It does not change when new runs are added — this is the address to cite.
n = 442 discoverable AI apps with a DACH connection · run Panel 2026-10-22 · closed on 22 October 2026
100% of the 442 scheduled targets were reachable; only reachable apps count.
The check in a real browser ran for 90% of the apps. Findings that are only visible there count over those apps only.
1%
4 apps
79%
349 apps
20%
89 apps
What stands out
The most common findings in the sample. The share says how many apps triggered the rule — counted only over the apps where the rule could check at all. It does not say whether the finding holds in any individual case.
Defects
Findings of medium severity and above that describe an observed state — a readable table, a tracker before consent, user input rendered unfiltered. They decide the verdict.
- Medium — SeverityRSC-ACC-004Accessibility violations in the rendered state77%
- Medium — SeverityRSC-ARC-005Non-existent paths answer with 20071%
- Medium — SeverityRSC-PRV-001Google Fonts loaded at runtime36%
- Medium — SeverityRSC-PRV-006Data sent to third-country services30%
- Medium — SeverityRSC-ARC-001Content rendered client-side only24%
- Medium — SeverityRSC-SCL-007Heavy first page load23%
- Medium — SeverityRSC-SEC-035Browser writes directly to the database23%
- High — SeverityRSC-PRV-003Mandatory legal pages not visible17%
- Medium — SeverityRSC-PRV-007Trackers without a consent layer17%
- Medium — SeverityRSC-PRV-017Service not named in the privacy policy15%
- High — SeverityRSC-PRV-005Trackers fire before consent13%
- Medium — SeverityRSC-SCL-002Very large JavaScript bundle13%
- Medium — SeverityRSC-SEC-019Role check inside the client bundle13%
- High — SeverityRSC-PRV-008Tracking cookies set before consent9%
- High — SeverityRSC-SEC-078Shipped library with a known vulnerability8%
Hardening and hygiene
Missing protective layers and hygiene — a header, a DNS record. They show up on almost every site because hardly anyone sets them, and they never tip a verdict. Prevalence is not severity.
- Low — SeverityRSC-SEC-092No CAA record99%
- Medium — SeverityRSC-SEC-003No Content-Security-Policy98%
- Low — SeverityRSC-SEC-005No clickjacking protection89%
- Low — SeverityRSC-SCL-004No caching strategy65%
- Low — SeverityRSC-ARC-004No canonical link45%
- Low — SeverityRSC-SEC-087DMARC with `p=none`38%
- Low — SeverityRSC-PRV-022Contact data in the shipped JavaScript33%
- Low — SeverityRSC-SEC-004MIME sniffing not disabled31%
- Low — SeverityRSC-SEC-024No Referrer-Policy31%
- Low — SeverityRSC-SEC-093No security.txt — no contact for vulnerability reports26%
- Low — SeverityRSC-ARC-006No robots.txt and no sitemap23%
- Low — SeverityRSC-PRV-002US trackers embedded in the shipped code16%
- Low — SeverityRSC-PRV-012Privacy policy: mandatory details not found14%
- Low — SeverityRSC-PRV-011Imprint: mandatory details not found14%
- Medium — SeverityRSC-SEC-084No SPF and no DMARC — email spoofing unprotected14%
By platform
| Platform | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Lovable | 183 | 0% | 73% | 27% |
| Base44 | 122 | 2% | 86% | 12% |
| Bolt | 101 | 0% | 82% | 18% |
By jurisdiction
| Jurisdiction | Apps | Stop | Iterate | Go |
|---|---|---|---|---|
| Germany | 171 | 0% | 75% | 25% |
| Switzerland | 196 | 2% | 85% | 13% |
Groups with fewer than 20 apps are not shown — not as “0%”, but not at all. From that few rows a single app could be picked out.
How to cite
Numbers and JSON are available under CC-BY 4.0. Please cite as “decivo AI App Radar DACH” with a link. Raw numbers as JSON
How the sample is built, what the scan loads and what it never does, and how to remove your domain: Radar methodology