Security contact, and a few hardening suggestions for apps that embed DSH

[alu1204]

Hi DSH team,

We build a desktop app that embeds DSH: the host, the agent loop, the sandboxed shell and file tools, and the web UI. Recently we reviewed how the app behaves when an agent works with untrusted content, and we have a few findings we would rather share privately than in a public thread.

Issues and private vulnerability reporting are turned off for this repository, and there is no SECURITY.md, so we could not find a private channel. Could you turn on GitHub private vulnerability reporting for deepseek-ai/deepseek-harness, or tell us an address to write to? A SECURITY.md that names the channel and what is in scope would help other embedders too.

SAFETY.md says DSH is an experimental preview and that the sandbox and approvals do not guarantee isolation; we take that as given. In the meantime, here are some general hardening suggestions. None of them depends on the private findings.

1. Show the sandbox boundary where people and the model see it. The docs already explain what workspace-write governs. The preset description in the UI and the sandbox context given to the model could say it in one sentence too, for example: "Writes are limited to the workspace; reading files and network access are not restricted."
2. Read-side and network options. Configurable deny-read roots and a network-off switch for sandboxed commands, enforced the same way by the runners and by the built-in file tools (read, glob, grep, read_image). A host could then keep its own data directory out of reach without patching packages.
3. More approval outcomes, and a host hook. Besides allow-once: allow for this session, and an "always ask" class that a host can attach to certain actions, such as anything that sends data out. It would apply when the sandbox mode does not change, and under the full-access preset too.
4. Dependencies.
   • Prefer caret ranges to exact pins for third-party packages.
   • Run npm audit or an OSV check in the release pipeline.
   • Publish the versions of third-party code bundled into published files, as an SBOM or a versioned list next to THIRD_PARTY_NOTICES.
   • Let hosts pass pnpm overrides or minimum versions to plugin installs.

Thanks for the work on DSH. We are happy to share the details, test cases and suggested patches privately.