Security
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues.
Send a private report
support@dummy-bi.comInclude a description of the issue, steps to reproduce, and the version you were using. We review all reports and respond as soon as we can. Responsible disclosure is credited unless you prefer anonymity.
Your Report Data Never Leaves Your Machine
The optional API connectors — Power BI service, Fabric, Azure DevOps, GitHub, and Databricks — connect directly to those services using credentials you provide. They are only activated when you explicitly use them. Dummy BI never sees or stores those credentials or the data returned.
Website signups, feedback, purchases, license delivery, and support emails are handled separately under the Privacy Policy.
Background network activity is limited to update checks and, where enabled, license validation. Sign-in and optional service connectors use the network only when you configure or invoke them. None of these requests route report contents through Dummy BI servers.
Supply Chain Security
Automated CI checks dependencies across all three ecosystems used by the tool. Release builds stop on unacknowledged high-severity dependency findings. The additional supply-chain scanner runs when its repository credential is configured.
| Ecosystem | Tool | What it catches |
|---|---|---|
| Python | pip-audit | Known CVEs in PyPI packages |
| Python | Hash-verified installs | Tampered or replaced packages |
| Node.js | npm audit | High/critical vulnerabilities |
| Rust | cargo audit | Security advisories in crates |
| All | Socket.dev (configured CI) | Malicious packages, typosquatting |
Verifiable Releases
The public release workflow is configured to produce:
SBOM
CycloneDX format
A complete list of every bundled dependency.
SHA-256 checksums
All installers
Verify file integrity before running.
Authenticode
Windows binaries
Publisher signatures on the installer and bundled executables.
Public installers, checksums, and SBOM files will be published on our GitHub Releases page.