rechtzeitig
A GitHub Action you start by hand. It opens your website as a new visitor from Germany would, reads your repository and points out technical signs that German and EU requirements may be missing, with the place it found them and the law they relate to.
rechtzeitig does not give legal advice and cannot tell you that your site is compliant. A finding is a hint to check, no finding is no all-clear.
- Imprint and privacy policy
DDG, GDPR
- Consent
Third-party requests and cookies before consent, the banner, TDDDG
- Contract buttons
Cancellation and withdrawal, BGB
- Security basics
HTTPS, TLS, headers, exposed files, error pages, email spoofing
- Repository
SBOM, known vulnerabilities, license conflicts, committed secrets
It is free and runs on GitHub's runners.
Start in two minutes
- Copy rechtzeitig.yml to
.github/workflows/rechtzeitig.ymlin your repository. - Open Actions → rechtzeitig → Run workflow, enter your URL and pick the language.
- Read the report on the run's summary page.
You need no secret to start. Checks that call an API with a token run only after you add that token as a repository secret. Without it they are skipped and send nothing. See Secrets.
Sends data to api.osv.dev
One official API without a token is on by default: the vulnerability lookup sends the names and versions of your locked packages to osv.dev. Turn it off with vulnerabilities: false. See What runs when.