dsh-code-security
A DeepSeek Harness code-security review plugin with deterministic local scanning, diff review, policy gates, baselines, SARIF export, and dependency inventorying.
Install
$ dsh plugin --profile web add dsh-code-securityPlugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Scans files and directories with 40+ deterministic security rules and reports CWE IDs, severity, line numbers, and code evidence.
- Reviews only added Git diff lines and verifies whether findings were resolved, remain, or were newly introduced after a fix.
- Reports aggregated findings and gate conclusions by rule and file.
- Exports SARIF 2.1.0 and Markdown reports.
- Supports accepted finding baselines and configurable exclusions, ignored rules, and severity thresholds through .code-security.json.
- Provides SBOM-lite dependency manifest and version-constraint risk analysis.
- Detects patterns covering injection, unsafe deserialization, weak cryptography, credential exposure, insecure configuration, sensitive logging, path traversal, and SSRF.
Useful For
- Run a local security scan after agent-driven code changes.
- Review newly added lines before submitting a Git change.
- Track legacy findings as an approved baseline while gating newly introduced issues.
- Export scan results for SARIF-compatible tooling or Markdown review.
- Apply repository-specific security exclusions and severity thresholds.
Who It Fits
- DeepSeek Harness users building or reviewing code with agents.
- Developers seeking deterministic local security checks.
- Teams that need diff-focused scans and policy-controlled security gates.
Documented Limitations
- Findings provide objective evidence and CWE identifiers but do not include remediation recommendations.
- The dependency feature is described as SBOM-lite and analyzes dependency manifests and version constraints.
- Requires Node.js 22.13 or later according to package metadata.
- Some operations write state or files and are marked as requiring approval gates in the README.
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- STARDUSTLC666/dsh-code-security
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 33f930d · 2026-09-18
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 1GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-09-13
- Last release
- No release detected
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
DSH undo and crash-recovery plugin with snapshots, rollback, Safe Mode, and offline Windows tools.
View plugin →DeepSeek Harness web-search plugin that adds web search, X search, and focused page fetching with structured evidence.
View plugin →Second-model AI auto-review for DeepSeek Harness approval requests with fail-closed safety and session audit.
View plugin →Local, fast cross-agent memory and session indexing system with DeepSeek Harness integration.
View plugin →