SampleSmith Injury Law · Austin, Texas

Compliance dossier · Fix + AI Prompts

Smith Injury Law

https://smith-injury-law.example

Version scanned

Repository: smithlaw/website @ main
Commit: 4f9c2e1
Committed: 26 Oct 2026, 08:41:12 UTC
Fingerprint: 9b1d4c7e2a8f
Files scanned: 214
Scanned at: 26 Oct 2026, 08:58:40 UTC

Results describe this version only. Any later change — code, dependencies, third-party services or copy — is a different version and needs its own scan.

The site is technically sound but carries three issues a Texas attorney cannot ignore: advertising that has not been filed with the State Bar's Advertising Review Committee, testimonials without required disclaimers, and a contact form that collects injury details without a privacy notice or retention policy. Fixing the top five items moves the Texas score from 41 to roughly 88.

Marketing website for a solo personal-injury attorney in Austin, Texas. Built with React and a hosted database. Includes a free case-evaluation form, a live chat widget, client testimonials and a blog.

TexasUnited States (federal)European Union

/ 100

Overall score

critical

high

medium

low

§1 · By jurisdiction

US-TX41

Texas

non-compliant

Attorney advertising rules and the Texas Data Privacy and Security Act both have open gaps.

US63

United States (federal)

partial

Accessibility issues create ADA Title III exposure; FTC disclosures mostly fine.

EU58

European Union

partial

Only relevant if you target EU visitors: analytics fire before consent.

Stack detected

—React 19
—TanStack Start
—Hosted Postgres
—Google Analytics 4
—Intercom chat
—Google Fonts

Personal data collected

—Full name
—Email
—Phone
—Description of injury (health data)
—IP address
—Analytics cookies

Third parties

—Google Analytics
—Intercom
—Google Fonts CDN

§2 · Findings

Prompts written for· detected Lovable (package.json uses lovable packages)

F-01criticalprofessionalDays to fixUS-TX

Website advertising not filed with the State Bar of Texas

Texas Disciplinary Rules of Professional Conduct

1 provision cited · show

US-TXTexas Disciplinary Rules of Prof. Conduct 7.05(a)–(f), 7.07(a)

What we saw: Homepage advertises legal services and results ("$2.4M recovered"). No filing reference or exemption basis found.
Why it matters: Texas requires most lawyer advertisements, including website content that goes beyond basic exempt information, to be filed with the Advertising Review Committee.
What to change: Submit the site to the State Bar's Advertising Review Department, or reduce homepage content to exempt categories. Keep a copy of the filing and the approval letter.

src/routes/index.tsx:42

before

<h2>$2.4M recovered for our clients</h2>

after

<h2>Results we have achieved</h2>
<p className="text-xs">Past results do not guarantee a similar outcome. Each case is different.</p>

prompt for Lovable

Make this change without altering anything unrelated, and keep the current design.

On the homepage, replace the "$2.4M recovered" heading with "Results we have achieved" and add a small disclaimer directly below it: "Past results do not guarantee a similar outcome. Each case is different." Do not change anything else.

Start in the file src/routes/index.tsx.

Done when:
- Submit the site to the State Bar's Advertising Review Department, or reduce homepage content to exempt categories. Keep a copy of the filing and the approval letter.
- The required disclaimer or notice appears on every page where the regulated content appears.
- A SafeLaunch quick check of the next push no longer reports "Website advertising not filed with the State Bar of Texas".

F-02criticalprivacyHours to fixUS-TXUS

Injury details collected with no privacy notice

Texas Data Privacy and Security Act

2 provisions cited · show

US-TXTDPSA §541.102 (notice); §541.101(b)(4) (sensitive data consent)
USFTC Act §5; FTC Health Breach Notification Rule 16 CFR 318

What we saw: The case evaluation form asks for a free-text description of injuries and stores it in the database. No privacy notice is linked from the form.
Why it matters: Health information is sensitive data. Processing it requires a clear notice and, for sensitive data, consent.
What to change: Add a consent checkbox linking to a privacy notice, state how long submissions are kept, and restrict database access to you only.

src/components/CaseForm.tsx:18

before

<button type="submit">Get my free evaluation</button>

after

<label className="flex gap-2 text-sm">
  <input type="checkbox" required name="consent" />
  I agree my details may be used to evaluate my case, as described in the <a href="/privacy">Privacy Notice</a>.
</label>
<button type="submit">Get my free evaluation</button>

prompt for Lovable

Make this change without altering anything unrelated, and keep the current design.

Add a required consent checkbox above the submit button of the case evaluation form with the label "I agree my details may be used to evaluate my case, as described in the Privacy Notice" (link Privacy Notice to /privacy). Save the consent value and timestamp with each submission. Create a /privacy page if it does not exist.

Start in the file src/components/CaseForm.tsx.

Done when:
- Add a consent checkbox linking to a privacy notice, state how long submissions are kept, and restrict database access to you only.
- No personal data is collected or sent to a third party before the user has been told (and, where required, has consented).
- A SafeLaunch quick check of the next push no longer reports "Injury details collected with no privacy notice".

F-03highprofessionalMinutes to fixUS-TX

Client testimonials without required disclaimer

Texas Disciplinary Rules of Professional Conduct — Rule 7.02 (communications about services)

What we saw: Five testimonials describe case outcomes with no qualifying statement.
Why it matters: Testimonials about results can create unjustified expectations unless properly qualified.
What to change: Add a visible disclaimer next to the testimonials section.

src/components/Testimonials.tsx:9

after

<section aria-labelledby="testimonials">
  <h2 id="testimonials">What clients say</h2>
  {testimonials}
  <p className="text-xs">Client testimonials describe individual experiences. Past results do not guarantee a similar outcome.</p>
</section>

prompt for Lovable

Make this change without altering anything unrelated, and keep the current design.

Below the testimonials section, add the sentence "Client testimonials describe individual experiences. Past results do not guarantee a similar outcome." in small readable text. Do not remove any testimonials.

Start in the file src/components/Testimonials.tsx.

Done when:
- Add a visible disclaimer next to the testimonials section.
- The required disclaimer or notice appears on every page where the regulated content appears.
- A SafeLaunch quick check of the next push no longer reports "Client testimonials without required disclaimer".

F-04highprivacyHours to fixEU

Analytics and chat load before any consent

GDPR / ePrivacy Directive — Art. 6 GDPR, Art. 5(3) ePrivacy

What we saw: Google Analytics and Intercom scripts load in the page head on first visit.
Why it matters: Non-essential cookies need prior opt-in consent for EU visitors.
What to change: Add a cookie banner and only load analytics and chat after the visitor accepts.

src/routes/__root.tsx:31

before

<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
<script src="https://widget.intercom.io/widget/abc123"></script>

after

{consent === "accepted" && (
  <>
    <script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX" />
    <script src="https://widget.intercom.io/widget/abc123" />
  </>
)}
<CookieBanner onChoice={setConsent} />

prompt for Lovable

Make this change without altering anything unrelated, and keep the current design.

Add a cookie consent banner with equal Accept and Reject buttons. Only load Google Analytics and Intercom after the visitor clicks Accept. Add a Cookie settings link in the footer to change the choice.

Start in the file src/routes/__root.tsx.

Done when:
- Add a cookie banner and only load analytics and chat after the visitor accepts.
- No personal data is collected or sent to a third party before the user has been told (and, where required, has consented).
- A SafeLaunch quick check of the next push no longer reports "Analytics and chat load before any consent".

F-05mediumaccessibilityMinutes to fixUS

Form inputs have no labels for screen readers

ADA Title III / WCAG 2.2 — SC 1.3.1, 4.1.2

What we saw: Inputs use placeholder text only.
Why it matters: Missing labels are among the most cited issues in web accessibility lawsuits.
What to change: Add visible or screen-reader labels to every field.

src/components/CaseForm.tsx:9

before

<input placeholder="Your email" />

after

<label htmlFor="email">Your email</label>
<input id="email" type="email" autoComplete="email" />

prompt for Lovable

Make this change without altering anything unrelated, and keep the current design.

Give every field in the case evaluation form a visible <label> linked by id, and set autoComplete attributes for name, email and phone.

Start in the file src/components/CaseForm.tsx.

Done when:
- Add visible or screen-reader labels to every field.
- The change works with keyboard only and is announced correctly by a screen reader.
- A SafeLaunch quick check of the next push no longer reports "Form inputs have no labels for screen readers".

F-06mediumsecurityMinutes to fixUS-TXUSEU

Missing security headers

OWASP Top 10 — A05 Security Misconfiguration

What we saw: No Content-Security-Policy, Strict-Transport-Security or X-Frame-Options headers returned.
Why it matters: Reasonable security measures are required under TDPSA §541.104 and GDPR Art. 32.
What to change: Add standard security headers at the server.

after

Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

prompt for Lovable

Make this change without altering anything unrelated, and keep the current design.

Add Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy headers to every response. Allow only the third-party domains the site needs.

Done when:
- Add standard security headers at the server.
- The issue can no longer be reproduced, and no secret or key appears in client-side code or the repository.
- A SafeLaunch quick check of the next push no longer reports "Missing security headers".

§3 · What you already do right

HTTPS enforced across all pages
No API secrets found in client code
Database rows are restricted to their owners
Lawyer's name and principal office city are shown (Rule 7.04(j))

§4 · Draft policy text

privacy notice

PRIVACY NOTICE (draft)

Who we are: [Firm name], [address], Austin, Texas.
What we collect: name, email, phone and the details you share about your case.
Why: to evaluate whether we can help you and to contact you.
How long: submissions that do not become a client matter are deleted after 12 months.
Your rights: you may request access, correction or deletion by emailing [email]...

§5 · Fix everything with one prompt

It walks your AI builder through every fix in priority order, with a "done when" check for each. Paste into the Lovable chat. Use Chat mode first to review the plan, then let it implement.

master prompt · Lovable

We're fixing compliance gaps in Smith Injury Law found by a SafeLaunch audit. Do them one at a time, in this order. After each, tell me what you changed. Keep the current design.

1. [CRITICAL] Website advertising not filed with the State Bar of Texas (src/routes/index.tsx)
On the homepage, replace the "$2.4M recovered" heading with "Results we have achieved" and add a small disclaimer directly below it: "Past results do not guarantee a similar outcome. Each case is different." Do not change anything else.
Done when: Submit the site to the State Bar's Advertising Review Department, or reduce homepage content to exempt categories. Keep a copy of the filing and the approval letter.

2. [CRITICAL] Injury details collected with no privacy notice (src/components/CaseForm.tsx)
Add a required consent checkbox above the submit button of the case evaluation form with the label "I agree my details may be used to evaluate my case, as described in the Privacy Notice" (link Privacy Notice to /privacy). Save the consent value and timestamp with each submission. Create a /privacy page if it does not exist.
Done when: Add a consent checkbox linking to a privacy notice, state how long submissions are kept, and restrict database access to you only.

3. [HIGH] Client testimonials without required disclaimer (src/components/Testimonials.tsx)
Below the testimonials section, add the sentence "Client testimonials describe individual experiences. Past results do not guarantee a similar outcome." in small readable text. Do not remove any testimonials.
Done when: Add a visible disclaimer next to the testimonials section.

4. [HIGH] Analytics and chat load before any consent (src/routes/__root.tsx)
Add a cookie consent banner with equal Accept and Reject buttons. Only load Google Analytics and Intercom after the visitor clicks Accept. Add a Cookie settings link in the footer to change the choice.
Done when: Add a cookie banner and only load analytics and chat after the visitor accepts.

5. [MEDIUM] Form inputs have no labels for screen readers (src/components/CaseForm.tsx)
Give every field in the case evaluation form a visible <label> linked by id, and set autoComplete attributes for name, email and phone.
Done when: Add visible or screen-reader labels to every field.

6. [MEDIUM] Missing security headers
Add Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy headers to every response. Allow only the third-party domains the site needs.
Done when: Add standard security headers at the server.

Finally, list anything you couldn't complete and why. Then I'll re-run SafeLaunch on the new version.

Get this for your app