If you've found a security issue in OpenCarIL, please do not open a public GitHub issue. Use either of:

• Preferred: GitHub's private vulnerability reporting → security advisories
• Email: security@nx1xlab.dev

Include:

• A short description of the issue
• Steps to reproduce (URL, headers, payload, expected vs observed)
• The impact you assess
• Optional: a patch / PR draft

A machine-readable contact policy is published at /.well-known/security.txt (RFC 9116).

We'll acknowledge within 72 hours and aim to ship a fix within 7 days for confirmed high-severity issues, longer for low-severity ones.

In scope:

• The OpenCarIL web app at opencar.nx1xlab.dev and the worker that powers it
• The ETL pipeline in this repo
• Deployment infrastructure (GitHub Actions, Cloudflare bindings)
• Dependency / supply-chain issues affecting the build

Out of scope:

• Bugs in data.gov.il itself - please report those to the Ministry of Transport directly via the contact form.
• Browser quirks unrelated to OpenCarIL's code.
• Self-XSS that requires the user to paste a payload into the dev console.

• All data OpenCarIL displays is already public on data.gov.il under their open license. OpenCarIL does not collect, store, or expose any user data.
• No authentication, no accounts, no cookies, no analytics scripts.
• Rate-limit binding (Cloudflare) on /api/* to limit abuse: 30 req per IP per 10 s. See web/wrangler.toml.
• Cache-Control per route with stale-while-revalidate. Edge cache hides D1 from the open internet for repeat queries.
• Secrets (CF_API_TOKEN, CF_ACCOUNT_ID, CF_D1_DATABASE_ID) are stored only as GitHub Actions secrets; never committed, never logged.

After a fix is released we'll credit the reporter in the CHANGELOG (under ### Security) unless the reporter prefers to stay anonymous.