Security is very important aspect of any software. Given that this repository hosts open government data visualisations, we prioritise data integrity, sanitation, and secure configuration.

Only the latest main branch is actively supported with security updates.

If you discover a security vulnerability within this project, please report it privately.

Do not open a public GitHub issue.

Instead, please email the maintainer at dangalsunil@gmail.com with a detailed description of the issue. We will strive to acknowledge your report within 48 hours.

This project adheres to the following security standards:

• No Hardcoded Credentials: We strictly enforce zero-tolerance for hardcoded secrets. All sensitive keys (SECRET_KEY, DB_PASSWORD, API_KEYS) are loaded via environment variables using python-dotenv.
• Git Hygiene: .env files and other local configuration files are explicitly excluded in .gitignore.

• Open Data Only: This project is designed to visualise publicly available datasets (e.g., ABS, AIHW).
• No PII: No Personally Identifiable Information (PII) is stored or processed.
• Sanitisation: The ETL pipeline (etl/loaddata.py) is designed to strip potential metadata outliers, though the primary input source is already anonymised public data.
• Git Exclusion: Raw data directories (data/, datas/) are git-ignored to prevent accidental uploads of large or unverified files.

• Pinned Versions: Dependencies are managed via pyproject.toml to ensure reproducible and secure builds.
• Regular Audits: We recommend running pip-audit or safety regularly to check for CVEs in third-party packages.

• Docker Isolation: The application runs in a containerised environment, minimising host system exposure.
• Debug Mode: DEBUG is disabled by default in production configurations.

This software is provided "as is", without warranty of any kind. Users deploying this dashboard in a public-facing environment should perform their own infrastructure penetration testing.