A well-done Redash fork can be used as a reference.

[Avey777]

refer to： https://github.com/dazdata/redash

Official website：https://redash.dazdata.com/

However, this mainly promotes the commercial version, and in terms of openness, it cannot compare to our community version of Redash.

[justinclift]

What seems to be better with the Dazdata fork? When I looked at it briefly a few weeks ago, they haven't improved the dependency versions so they likely have the same security vulnerabilities as the main getredash repo.

[Avey777]

The commercial version of Daztada does indeed offer many additional features. As someone based in China, I happen to know some of the employees working for Daztada personally, and they have made significant improvements to Redash's commercial version that suit China's national conditions and requirements.

[justinclift]

Cool. Can you ask them if they've updated the dependencies in their commercial version to no longer have security vulnerabilities?

[Avey777]

I consulted with them, and the commercial version has made some security vulnerability fixes, but not all of them.

To be precise, they have fixed all the critical vulnerabilities. The less severe ones have not been addressed.

[justinclift]

To be precise, they have fixed all the critical vulnerabilities.

Cool. Would you be ok to ask them if they could share those fixes with us?

[Avey777]

They operate commercially, so everything they can share is in their Redash fork.

However, I think contacting them directly may yield different results.