Avoid implicit token use in public stats Space

get_dataset_stats.py

@@ -34,7 +34,9 @@ def get_dataset_stats(
         - format_version: Detected format version (v2.1 or v3.0)
     """
     api = HfApi()
-    token = hf_token or os.environ.get("HF_TOKEN")
+    # Public Space: use an explicit token only if the caller passes one.
+    # Do not implicitly use HF_TOKEN, so visitors cannot proxy private data through this app.
+    token = hf_token
     
     logger.info(f"Fetching stats for dataset: {repo_id}")