Aero123421/dsh-security-plugin
DSH Security is a security review plugin for DeepSeek Harness that adds a Security page to the sidebar: built-in deterministic analyzers run over a read-only project snapshot (a 25-rule secret scanner, 50 pattern rules for JS/TS, Python, Dockerfiles, Compose and Kubernetes, endpoint discovery for many web frameworks, and lock-file reading), then multi-agent AI reviewers hunt for real attack paths while every AI claim must quote exact code that the host verifies against the snapshot, and an independent skeptic tries to refute each finding. Results stay on your machine and export as Markdown, JSON or SARIF.
DSH Security is a security review plugin for DeepSeek Harness that adds a Security page to the DSH sidebar. Built-in deterministic analyzers run over a read-only project snapshot: a secret scanner with 25 rules (which also does the redaction), 50 pattern rules for JavaScript/TypeScript, Python, Dockerfiles, Compose and Kubernetes, endpoint discovery for Express, Fastify, Koa, Hono, NestJS, Next.js, Flask, FastAPI and Django, lock-file reading for npm, PyPI, Go and Cargo, and optional OSV.dev, Gitleaks, OSV-Scanner or Semgrep extras. Then a read-only multi-agent review runs: a Planner builds a threat model, Hunters investigate endpoints, rule hits, sensitive files and the planner's hypotheses, and in Research mode a Chain analyst looks for combined attacks. Every AI claim must quote the exact code it relies on; the host checks each quote against the redacted snapshot and drops claims it cannot verify, so findings with no verified step are discarded and the discarded count is shown under Coverage. An independent skeptic that sees only the claim and the verified code then tries to refute each finding, and results can be exported as Markdown, JSON or SARIF.
Install
dsh plugin --profile web add -w github:Aero123421/dsh-security-plugin#v0.1.0Copied verbatim from the README's install block, which pins tag v0.1.0 and passes -w; a local checkout form dsh plugin --profile web add /absolute/path/to/checkout is also documented.
Compatibility
For DSH 0.2.x. A scan runs built-in analyzers over a read-only snapshot of your project, and the AI reviewers run on the models you already connected in DSH but can only list, read and search files in the snapshot - no shell, no network access and no way to write files. Results stay on your machine. English README with a Japanese translation.
Details
- Repo: Aero123421/dsh-security-plugin
- Category: Tools & Capabilities
- Stars: 0
- Version: GitHub repo Aero123421/dsh-security-plugin (0★); installed from GitHub at tag v0.1.0 (no npm package is documented).
- Last push: 2026-10-14
- First seen: 2026-10-13
Alternatives
1321928757/dsh-api-kit · 1321928757/dsh-mysql · 1624318455/dsh-plugin-tavily