Independent Enclave · Owner-Reviewed
Offline Security & Zero CJI Architecture
A small, static, privacy-minimizing surface designed for high-assurance reference with zero accounts, zero application databases, and zero CJI-processing capability.
01 / BOUNDARY
Public reference, not an operational system
Scope limitations and strict zero-input boundary.
The Independent Illinois Offense Code Reference project provides an informational statutory reference. It is not an operational police dispatch system, records management system (RMS), or criminal justice information (CJI) repository.
Do not enter personal or operational data: Never enter suspect names, victim identifiers, registration plates, driver license numbers, case numbers, investigative narratives, or CJI into search or any other field on this site.
- • Complete Client Isolation: All queries, calculations, and filters execute locally in device RAM.
- • Prohibited Content: Strictly no storage or transmission of criminal justice or personal identifying information.
02 / CONTROLS
Technical controls and architecture
Defensive headers, zero trackers, and static integrity.
The entire application is distributed as static HTML, CSS, and modern JavaScript modules. There is no server-side application logic, database backend, or API capable of recording search telemetry.
All communication is secured with HTTP Strict Transport Security (HSTS) with a 2-year preload directive, strict Content Security Policy (CSP), and nosniff headers. Third-party trackers and telemetry SDKs are prohibited.
- • Static Enclave: Zero application servers, zero SQL backends, zero user session tracking.
- • Hardened Delivery: Strict CSP and HSTS preload enforced across all edge CDN endpoints.
03 / REPORTING
Vulnerability disclosure process
Public issue tracking and RFC 9116 security contact.
Security findings, extraction discrepancies, or integrity concerns may be submitted directly to kirbyjosh28@gmail.com. Reports are reviewed by the project maintainers.
The project publishes an RFC 9116 security declaration at /.well-known/security.txt outlining reporting channels and contact details.
- • Direct Intake: Dedicated inbox (kirbyjosh28@gmail.com) monitored for reproducible technical vulnerabilities.
- • Private Channel: Use direct email to disclose sensitive technical details responsibly.
04 / STATUS
Evidence before claims
Automated regression gates and release governance.
Threat modeling, header verification, hostile-input testing, dependency review, rollback guidance, and artifact checksums are part of the release evidence. Review was performed by the owner and automated checks, not by an independent security assessor.
Operated by the Independent Illinois Offense Code Reference project. Owner-reviewed August 10, 2026.
- • Continuous Automated Gates: Over 490 automated test suites audit CSP, headers, and zero-runtime deps.
- • Tamper-Proof Delivery: Shipped bundle checksums verified against cryptographic manifests before deployment.