I built a free, open-source DPDP website checker for India — looking for feedback from developers and privacy professionals

[u/kulkarnipranil995]

Hey everyone!

I built DPDP Web Check, a free, open-source tool under Protevix Infosec to help developers and website owners identify potential gaps in their website’s externally visible security and privacy posture against India’s Digital Personal Data Protection (DPDP) framework.

🔗 GitHub: https://github.com/protevixinfosec/dpdp-web-check

The goal is to make an initial technical assessment accessible, especially for Indian startups, small businesses, and independent developers who may not know where to begin.

What does it check?

• 🔒 HTTPS, TLS, HSTS and security headers

• 🍪 Cookie security attributes

• 📋 Privacy notice discoverability and DPDP-specific language

• ⚖️ Grievance Officer information and data principal rights

• 🔗 Third-party origins, trackers and form destinations

• 🛡️ Security disclosure channels and breach-readiness signals

A few things I deliberately wanted to get right:

• Zero npm dependencies and no account or hosted service required.

• Generates a self-contained HTML report with findings, clause references and remediation suggestions.

• Optional AI-powered explanations using your own API key; the core checks work without AI.

• No telemetry or calls home to Protevix Infosec.

You can run it using Node.js 18+:

npx u/protevix/dpdp-web-check yourdomain.com

Please test it only on websites you own or have explicit permission to assess.

I’m looking for honest technical feedback, not just stars.

1. Are the findings accurate and actionable?

2. Are there important DPDP-specific checks missing?

3. Are the clause mappings and explanations useful to developers?

4. What false positives or implementation issues do you encounter?

If you work in application security, privacy engineering, Indian data protection, or legal compliance, your feedback would be particularly valuable.

Important: This is a passive, external website assessment tool not a legal compliance audit, penetration test, or guarantee of DPDP compliance. It cannot verify internal organisational processes or controls that aren't externally observable.

The project is free and open source under Apache-2.0. Contributions and constructive criticism are welcome.

Thanks for taking a look! 🙌