Deterministic code security review: 40+ rules, secret entropy detection, staged-diff review, SARIF export, baseline acceptance, SBOM-lite dependency inventory and health self-check. A step-by-step first-run guide (4 steps) now opens inside its settings panel.
Install
# from npm (prebuilt)
dsh plugin --profile web add dsh-code-security
# from GitHub (first run asks for allowBuilds approval — follow the hint, retry)
dsh plugin --profile web add github:STARDUSTLC666/dsh-code-security
Any plugin you install runs third-party code with your own permissions — it can read your files, use your credentials, and reach the network, and tool approvals don’t sandbox it. GitHub-sourced plugins also run build scripts at install time — pnpm blocks those until you allow them, so an install can stop with ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS; dsh prints the exact key to add under allowBuilds in your profile’s pnpm-workspace.yaml, and the install works on the next run. Allowing a build is a trust decision: only install sources you trust, and pin a commit (github:owner/repo#sha).
README
简体中文 · English
Code Security
Inspect security findings and verify the fixes.
Install · Workflow · Full guide
Features
- Scan files, directories or a Git diff.
- Inspect locations, rules, coverage and redacted evidence.
- Recheck the same scope and export Markdown or SARIF when needed.
Install
Open Plugins in the DSH desktop app and install dsh-code-security. If the CLI is available:
dsh plugin --profile desktop add dsh-code-security
For the web profile, replace desktop with web. Restart that DSH profile after installation. The package’s DSH requirement is >=0.2.2-rc.3.
Start using it
- In the target repository session, choose the whole project or current Git changes.
- For example: “Review these changes for security issues; report concrete triggers and code evidence.”
- Open Code security in the sidebar and inspect file locations, rules and evidence; prepare optional scanners separately.
- Recheck the same scope after fixing it, keeping false-positive reasons and unresolved human decisions.
Example request：
Check the current Git diff for security findings with triggers, locations and code evidence.
Before you start
Betterleaks, Semgrep CE and OSV are optional additions; a scan does not prove the absence of vulnerabilities.
Configuration, detailed tools and troubleshooting: full reference.
Plugin updates
Check updates at the bottom of the workbench or native plugin details. Automatic checks are on by default; automatic installation is off. You choose whether to install and when to restart. Suite-managed components update with their bundle. Update behavior.
Documentation
Feedback and contributions
If the plugin helps, a Star makes it easier for others to discover. Report problems or suggest improvements in Issues; code and documentation PRs are welcome. Include versions and reproduction steps, and remove credentials from reports.
License
Links
More in this category
kenryu42/cc-safety-net★ 2025
Pre-execution guard that blocks destructive Git and filesystem commands and access to secrets such as SSH keys and .env files before a tool call runs.
ADWMC/helm-d#helmd★ 1266
Security-analysis plugin for DeepSeek Harness: 33 tools spanning six security domains, evidence/reporting and toolbox, plus the case lifecycle, routing and tool ledger; a session-bound case workflow with an evidence chain, E-id validation and reproducible findings; 362 on-demand references; three hot-swappable persona profiles; and a four-tab workbench (armor / case / intercept / about) with case-state recovery after context compaction.
toby-bridges/api-relay-audit★ 914
Runs local security audits of AI API relays and LLM proxies from DeepSeek Harness, producing Markdown reports for prompt injection, model substitution signals, tool-call rewriting, error leakage, stream integrity, and profile-gated Web3 risks.
SeaOf0/dsh-redteam-model★ 877
Authorized-security DSH collection: nine work modes (redteam coordinator, pentest, code audit, binary analysis, attack-defense, AV evasion, incident response, cloud security, CTF solving) and fifteen runtime plugins, managed from a settings page with one-click deploy, install, update and uninstall.
howmp/dsh-pentest★ 621
Authorized pentest mode for DeepSeek Harness — exploration chain, assets and findings with a Web view.
PerryLink/dsh-auto-review★ 248
Second-model auto-review on the approval answerer chain: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default.
Community comments
Comments are public GitHub Discussions. Loading them connects to GitHub and Giscus; a GitHub account is required to post.