dash — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dash (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build interactive, reactive web apps with Dash. Dash apps are stateless: every callback must be safe to run on any worker, in any order, without depending on state left behind by another callback or another user's session. Most Dash bugs — inconsistent output, data leaking between users, apps that stop scaling — trace back to breaking this rule.
Input/Output/State, chained callbacks, multiple inputs/outputsALL, MATCH, ALLSMALLER)dcc.Store, server-side caching)Not for: authoring the underlying Plotly figures themselves (see Plotly Express/graph_objects docs), non-Dash Flask/FastAPI apps, or Dash Enterprise-only features beyond what is documented on the public Dash Python User Guide. This skill also does not cover the visual or accessibility design of the dashboard (layout strategy, colour semantics, KPI panel critique) — only the callback wiring and data architecture underneath.
see and change (layout/components), what triggers a re-render vs. what's read only on submit (Input vs State), what data must survive between callbacks or page loads (browser session vs. server-side), and whether this is a single page or needs routing. Ask about concurrency (single analyst vs. many simultaneous users) — it decides whether global variables are merely bad practice or an active data-leak risk.
dash.html (HTML tags) and dash.dcc (interactivecomponents) into a tree assigned to app.layout. Give every component that a callback references a stable id. Extract repeated markup into small functions that return components rather than copy-pasting blocks. See layout and reusable components.
Input (fires the callback) vs. State (read but doesn't fire it) — seeshould always update together) vs. separate callbacks (when inputs differ, or outputs should update independently/in parallel) — see combining outputs.
ctx.triggered_id when several inputs feed one output and you need to branch on whichone fired, instead of guessing from values — see determining the trigger.
id plus ALL/MATCH/ALLSMALLER when the number of components is dynamic(added/removed at runtime) — see pattern-matching callbacks.
variables, dataframes, or caches that other sessions/workers read — Dash runs across multiple processes/threads with no shared memory by default, so this silently corrupts results for other users. Reassign to a new local variable instead. For anything that must persist across callbacks, pick a sharing strategy sized to the data:
dcc.Store (browser-side, JSON-serialized).precomputed/aggregated result, not the full raw dataset.
filesystem), keyed by a session id stored in dcc.Store if it must stay per-user. Full trade-offs and code: sharing data between callbacks.
Move to a clientside callback only for cheap, pure transforms where round-trip latency or payload size dominates (it blocks the browser's main thread and can't touch server state/DB connections). Move to a background callback (background=True with a DiskcacheManager locally, CeleryManager+Redis in production) for anything that risks a ~30s timeout or would tie up a web worker. See performance and execution models.
(use_pages=True, dash.register_page, dash.page_container) over hand-rolled dcc.Location routing unless you're constrained to an older Dash version. Watch for the circular-import trap when a page needs the app object. See multi-page apps.
them (mock ctx.triggered_id via contextvars when the logic depends on it). Add dash.testing end-to-end tests only where interaction order or real DOM state matters. See testing.
the actual server backend, entry point, worker model, and hosting platform instead of deriving them from a local example. Any callback may execute on any available worker, so confirm the app has no assumptions that break under that model before calling it done. See deployment.
Input: "Users can add any number of city filters; each should read from a dataset that's expensive to compute once, cheap to reuse. Multiple users will use this at once." Expected output: A layout with an "Add filter" button producing pattern-matching (ALL) dropdowns, a dcc.Store holding the precomputed aggregate keyed off the shared inputs, and a graph callback that filters that aggregate without recomputing it. See the runnable version in examples/app.py.
Input: "I have two buttons that both need to update the same graph, and Dash complains about duplicate callback outputs." Expected output: A recommendation to combine the callback and branch on ctx.triggered_id (preferred when only one should ever be "live"), or use allow_duplicate=True with prevent_initial_call=True when the callbacks must stay separate — with an explicit note that update order between duplicate outputs isn't guaranteed. See duplicate outputs.
dash, dash.html, dash.dcc APIs; don't invent component props orcallback arguments that aren't in the current Dash User Guide.
dcc.Store payload is still transported over the network on every callback that readsit — for large data, store aggregates/subsets, not the full frame. Treat it as untrusted input on the way back in: validate shape before indexing into it.
allow_duplicate=True requires prevent_initial_call=True on that callback, orDash(prevent_initial_callbacks="initial_duplicate") on the app.
process managers, and hosting configuration belong to the consuming project.
architecture (layout, data sharing, multi-page, performance, testing, deployment). Runnable example: examples/app.py with tests in examples/test_app.py.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.