Art. 32/33 GDPR

Database readable without a login
Your app's database (often Supabase or Firebase) answers requests without any authentication — anyone with the URL can read the tables, including whatever user data they contain.

Art. 32 GDPR

Admin key exposed in frontend code
A service-role or admin API key is shipped inside the JavaScript your visitors download. Anyone can extract it and act as your backend.

Art. 44 GDPR

Google Fonts loaded directly from Google
Your app loads fonts from fonts.googleapis.com / fonts.gstatic.com. Every visitor's IP address is sent to Google servers in the US.

Art. 6 GDPR

Third-party tracking service embedded
An analytics or advertising script (Google Tag Manager, Meta Pixel, TikTok, Hotjar …) is embedded and sends visitor data to its vendor.

§ 25 TDDDG

Tracking cookie set without consent
A cookie used for tracking is written to the visitor's browser on the first page view, before any consent dialog.

§ 25 TDDDG

Tracking loads before anyone could consent
Tracking scripts fire on page load and no consent banner exists (or it loads too late). Data flows before the visitor had any choice.

Art. 32 GDPR

Resources loaded over unencrypted connections
Your HTTPS page loads some scripts, images or styles over plain HTTP.

§ 5 DDG German market

No imprint (Impressum) found
We couldn't find a page recognizable as an imprint at the usual paths or in the footer.

Art. 13 GDPR

No privacy policy found
No page recognizable as a privacy policy is linked from your app.

Art. 32 GDPR

Source map publicly accessible
Your build ships .map files that reconstruct the original source code — including comments, internal URLs and sometimes secrets.

Security header

No Content-Security-Policy
Your app is served without a CSP header, so the browser will run any script that gets injected into the page.

Security header

No HSTS (or lifetime too short)
The Strict-Transport-Security header is missing or expires quickly, so browsers may still try plain-HTTP connections.

Security header

No clickjacking protection
Your app can be embedded in a hidden iframe on someone else's page (no X-Frame-Options / frame-ancestors).

Security header

No nosniff header
Without X-Content-Type-Options: nosniff, browsers may guess content types and execute files that were never meant to be scripts.

BFSG German market

Basic accessibility gaps (BFSG)
Missing language attribute, page title, image alt texts or form labels — the machine-readable basics assistive technology relies on.