rechtzeitig
A GitHub Action you start by hand. It opens your website as a new visitor from Germany would, reads your repository and reports which German and EU requirements are met and which are missing.
- Imprint and privacy policy
DDG, GDPR
- Consent
Third-party requests and cookies before consent, the banner, TDDDG
- Contract buttons
Cancellation and withdrawal, BGB
- Security basics
HTTPS, TLS, headers, exposed files, error pages, email spoofing
- Repository
SBOM, known vulnerabilities, license conflicts, committed secrets
It is free and runs on GitHub's runners.
Start in two minutes
- Copy rechtzeitig.yml to
.github/workflows/rechtzeitig.ymlin your repository. - Open Actions → rechtzeitig → Run workflow, enter your URL and pick the language.
- Read the report on the run's summary page.
You need no secret to start. Checks that call an API with a token run only after you add that token as a repository secret. Without it they are skipped and send nothing. See Secrets.
Sends data to api.osv.dev
One official API without a token is on by default: the vulnerability lookup sends the names and versions of your locked packages to osv.dev. Turn it off with vulnerabilities: false. See What runs when.