DATA COLLECTION· 12
Forms
3
public/etb/index.html, public/partials/contact.html, public/retro/partials/contact.html
API endpoints
5
POST /api/report, POST /, POST /reload, POST /owners, POST /generate-style
Cookies
3
cookie_data
Trackers
1
Google Analytics
TRANSPORT
HTTPSenforced
Cert expiry2026-05-29
Headers
6/6
csp ✓, hsts ✓, xFrameOptions ✓, xContentTypeOptions ✓, referrerPolicy ✓, permissionsPolicy ✓
DEPENDENCIES
Critical0
High0
Medium0
Last audit2026-09-06
ACCESS CONTROLS
Branch protectionenabled
Required reviews1
Signed commitsno
AI SYSTEMS· 2
OpenAI · openai
LIMITED
.grc-scanner/scanner/ai/provider.ts, src/server.ts
Anthropic · direct API call
LIMITED
.grc-scanner/scanner/ai/provider.ts
THIRD-PARTY· 2
Resend
DPA ✓
purpose: email delivery, shares: email, name, message_body, DPA: https://resend.com/legal/dpa
Google Analytics
NO DPA
purpose: analytics/tracking, shares: ip_address, browsing_behavior, device_info
GOVERNANCE ARTIFACTS
Privacy PolicyGENERATED
└ served—
Terms of ServiceGENERATED
└ served—
security.txtPRESENT
└ served—
Vuln DisclosurePRESENT
└ served—
Incident Response PlanPRESENT
└ served—
AI Usage PolicyPRESENT
Served state never checked. Click CHECK PRODUCTION above to populate — only URLs declared in
policy_urls: are verified.