Skip to main content

Security report for whatbrandonthinks.online

What Brandon Thinks · Technology

Security score

56/100

Risk levelMedium

12 critical or high findings to fix

What Brandon Thinks is an independent technology service offering WhatsApp chat analysis through local statistics and optional AI-generated reports. The platform targets WhatsApp users seeking deeper insights into their conversations, emphasizing privacy and user control. The business operates on a freemium model, providing free local statistics and charging a one-time fee for AI reports. The website is professionally designed with clear navigation, comprehensive FAQs, and legal disclosures, positioning it as a trustworthy niche player in chat analytics. Technically, the site leverages modern web technologies including React and Next.js, ensuring fast performance and excellent mobile optimization. The integration with Google Gemini AI for chat analysis is done with explicit user consent, and chat data is processed locally before any transmission, reflecting a mature approach to data privacy. SEO and accessibility are well addressed, contributing to a positive user experience. From a security perspective, the site enforces HTTPS and includes standard security headers, with no detected vulnerabilities or exposed sensitive data. However, it lacks a dedicated security policy and incident response contact, and does not implement a cookie consent mechanism, which are areas for improvement. The domain uses privacy protection, which aligns with the service's privacy focus and does not raise immediate trust concerns. Overall, What Brandon Thinks demonstrates a strong security posture and privacy-conscious design, with a clear business focus and professional web presence. Strategic enhancements in privacy compliance and security transparency would further strengthen its trustworthiness and regulatory alignment.

Scanned

NIS2 and GDPR posture

NIS2 posture
17/ 100
GDPR posture
53/ 100
Checks completed
7of 7

Indicative only: based on publicly visible signals, not a certification or legal assessment. NIS2 signals relate to Article 21 of Directive (EU) 2022/2555; GDPR signals to Articles 7, 12, 13 and 32 of Regulation (EU) 2016/679 and Article 5(3) of the ePrivacy Directive.

Priority findings

12 findings rated critical or high. Fix these first.

  1. Email security

    SPF, DKIM and DMARC stop others sending email that looks like it comes from your domain, a common route to phishing and invoice fraud.

  2. Security headers

    Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

    • High

      Missing Strict-Transport-Security header

      Forces HTTPS connections

      What to do: Add "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"

      • CWE-319
      • OWASP A04:2025
      • ASVS V3.4.1
      • RFC 6797 §6.1.1
      • Mozilla TLS: Mozilla Server Side TLS 6.0 intermediate: hsts_min_age 63072000
      • NIS2 21(2)(h)
      • IR 2024/2690 9.2(a): Implementing Regulation (EU) 2024/2690, Annex point 9.2(a): Cryptography
      • NIST SC-8: NIST SP 800-53 Rev. 5 SC-8: Transmission Confidentiality and Integrity
    • High

      Missing X-Frame-Options header

      Prevents clickjacking attacks

      What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"

    • High

      Missing Content-Security-Policy header

      Controls resources the browser is allowed to load

      What to do: Implement a Content-Security-Policy appropriate for your application

      • ASVS V3.4.3
      • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

  3. GDPR compliance

    These are the privacy signals visitors and data protection authorities look for under GDPR.

    • High

      No Cookie Policy found

      GDPR requires clear information about cookie usage

      What to do: Add a dedicated cookie policy explaining cookie usage and purposes

Need hands-on remediation? Email guard@offseq.com

Keep watching whatbrandonthinks.online

This scan found 33 issues across 7 checks. Monitoring re-runs every one of those checks daily, emails you when something material changes, and records each issue as it is resolved, so you can show the progress.

Daily monitoring

Recommended

€25per month

  • TLS certificates and expiry
  • DNS records
  • SPF, DKIM and DMARC
  • Security headers
  • GDPR and NIS2 posture
  • Exposed services
  • Third-party trackers
  • Risk score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly. Cancel anytime. The full timeline opens with your unlock code.

Full report

€39.90one-time

  • The complete analysis as a PDF you can cite
  • Email delivery with an unlock code
  • Lifetime access to this report

Prices incl. 21% vat. Payments by EveryPay; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

The company occupies a niche market in chat analytics, focusing on WhatsApp conversations. Its competitive advantage lies in combining local data processing with optional AI insights, catering to privacy-sensitive users. Revenue is expected from one-time AI report purchases, with free local statistics driving user engagement. The target customers are individuals and small groups interested in understanding communication patterns. The absence of subscription models suggests a low-barrier entry for users. The company maintains independence from WhatsApp and Google, which may appeal to privacy-conscious users. The partnership with Google Gemini AI indicates a strategic use of advanced AI capabilities without direct dependency on large platforms. Growth potential exists in expanding AI features and possibly integrating other messaging platforms. The company’s ecosystem includes user testimonials and illustrative content to build trust and demonstrate value.

Security posture

The website exhibits a mature security posture with HTTPS enforced and multiple security headers implemented. The local processing of chat data before user consent minimizes data exposure risks. The explicit disclaimers about AI limitations and privacy demonstrate awareness of potential misuse and user expectations. However, the lack of a published security policy and incident response contacts limits transparency and preparedness communication. No vulnerabilities or insecure libraries were detected in the provided content. The absence of cookie consent mechanisms may pose compliance risks under GDPR and similar regulations. Overall, the security culture appears proactive but could benefit from formalized policies and user-facing security documentation.

Recommendations

  1. Implement a cookie consent banner to ensure compliance with EU and other privacy regulations.
  2. Publish a dedicated security policy page detailing security measures and user data handling.
  3. Add incident response contact information such as security@ or abuse@ email addresses.
  4. Consider creating and publishing a security.txt file to facilitate vulnerability disclosures.
  5. Regularly review and audit third-party AI provider integrations and scripts for security and privacy compliance.
Site observations

Automated reading of the public site. Ratings are indicative.

Business

Company
What Brandon Thinks
Description
Understand your WhatsApp conversations with private chat statistics and AI reports grounded in real messages. Import a TXT or ZIP export and explore your chat.
Key services
Local WhatsApp chat statistics, Optional AI-generated chat analysis reports, Reply drafting assistance
Content quality
excellent
Branding
consistent

Technology

Stack
React, Next.js, Google Gemini AI (configured AI provider), SVG icons
Frameworks
Next.js
Platforms
Web browser
Performance
fast
Mobile
excellent
Accessibility
good
SEO
good

Security

Observed score
90/100
Good practices seen
  • HTTPS enforced
  • Local processing of chat files before consent
  • Explicit user consent before sending data to AI provider
  • No direct WhatsApp account connection
  • Clear disclaimers about AI limitations and privacy

Analytics and tracking

Tracking level
minimal
Privacy compliance
good

Advertising

Transparency
poor

Site quality

Design
excellent
User experience
excellent
Content relevance
excellent
Navigation
excellent
Professionalism
excellent
Trustworthiness
high

Key observations

  1. Website provides a specialized WhatsApp chat analysis tool with local statistics and optional AI reports.
  2. Strong emphasis on privacy and user consent before sending data to AI providers.
  3. No direct WhatsApp account integration, reducing security risks.
  4. Clear and comprehensive FAQ and legal pages.
  5. No cookie consent mechanism detected, which may be a compliance gap.
  6. No phone contact information found; only email support available.
  7. No advertising or tracking scripts detected, indicating privacy-conscious design.
  8. Use of modern web technologies and good SEO practices.
  9. No security policy or incident response contact information publicly available.
Technical notes

Notes

The website is built on a modern React and Next.js stack, leveraging server-side rendering and client-side hydration for performance and SEO benefits. It uses SVG icons and asynchronous JavaScript loading to optimize user experience. The site is mobile-optimized with responsive design and accessible navigation. No CMS is detected, indicating a custom or static site approach. Hosting provider details are not explicit but the site uses HTTPS with strong SSL configuration. Performance is fast with minimal blocking scripts. The technical implementation supports scalability and maintainability. Opportunities exist to enhance privacy compliance features and add formal security documentation to reduce technical debt related to governance.
Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are resolved at build time from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures.

Retrieved 2026-10-24

Reviews of this site

Share your experience with whatbrandonthinks.online. Every review is verified by email and published after moderation.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

Loading reviews…

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.