Browser protections
Content Security Policy, frame denial, MIME-sniffing prevention, restricted browser permissions, origin isolation and strict referrer handling are attached to application responses.
Security standard
A small attack surface, enforced at the edge.
The publication does not require an account, accept payments or store reader-submitted vehicle data, which keeps the attack surface small by design instead of by policy alone. Security controls apply to every response: Content Security Policy, frame denial, MIME-sniffing prevention, restricted browser permissions, origin isolation and strict referrer handling. The public VIN, recall, safety and fuel-economy tools query government data directly and do not store submitted VINs or search terms in a publication database, and public calculators run entirely in the browser without submitting their values anywhere. Dependencies and platform behavior are reviewed with production changes, with unsupported capabilities removed, not left exposed. 5 common questions are answered below, and the machine-readable policy is published at its standard well-known path.
No reader accounts
There is no password database, profile system, checkout or document-upload flow. Public calculators operate in the browser and do not submit their values to the publication.
Bounded public tools
VIN, recall, safety and fuel-economy tools request public government data. VINs and search terms are used for the requested lookup and are not stored in a publication database.
Responsible reporting
Potential security issues can be reported through the corrections channel. The machine-readable security policy is published at the standard well-known path.
Open security.txt →Operating boundary
Security is maintained, not declared finished.
Dependencies, platform behavior and browser requirements change. Security controls are reviewed with production changes; unsupported capabilities are removed instead of left exposed.
This page describes the current application boundary and does not claim that any internet property is invulnerable.
What response headers does this site set on every page?
A Content-Security-Policy restricting scripts, styles and connections to this origin, the specific government APIs the tools query, and Cloudflare's Turnstile bot check on the contact page; X-Content-Type-Options: nosniff; X-Frame-Options: DENY; a strict Referrer-Policy; a restrictive Permissions-Policy disabling camera, microphone, geolocation, payment and USB access; Cross-Origin-Opener-Policy; and, on HTTPS, HTTP Strict Transport Security with a one-year max-age.
Does this site use cookies or track visitors individually?
No account system exists, so there is no session cookie tied to an identity. The publication does not run a third-party advertising or tracking pixel.
Are VINs or search terms I enter in a tool stored?
No. A VIN entered in the decoder or a year/make/model entered in the recall, ratings or configuration tools is used only to make the requested lookup against the relevant public government API and is not written to a publication database.
How do I report a security issue?
Through the corrections channel, the same reporting route used for factual corrections. A machine-readable policy is also published at the RFC 9116 standard path, /.well-known/security.txt, naming the contact route and an expiry date.
Does a strict security policy mean the site is invulnerable?
No, and this page does not claim that. It describes the boundary this application actually maintains today, a bounded attack surface with no accounts, no payments and no stored reader data, not a guarantee against every possible vulnerability.