[security] 请立刻关闭DSH中的“在使用官方模型 API 时上传 Session Log”选项！！！/ Please IMMEDIATELY DISABLE the "Upload Session Log when using the official model API" option in DSH!!!

[HQ123-BOOP]

DeepSeek Harness客户端内置了"@deepseek-ai/dsh-session-log-deepseek"插件且默认启用，本插件会在每次官方 DeepSeek API 请求中附带"dsh_session_log"字段，内容为规范会话日志的增量事件，且未在代码中发现任何脱敏处理。直接原样上传了我的共 16 条会话、3682 条"session-log-deepseek/delivery-accepted"接受记录；各会话最大水位之和约 27398 个事件。其中会话 session-aa9dda1c-b7f4-4dfe-950d-8ed4e1c0d2a1 的 9382 个事件中有 9374 个处于已上传水位之内（最大 throughSeq 9869，末次接受时间 2026-09-30 01:59 前后）。上传内容并不限于模型输入输出，还包括未进入模型请求的元数据事件（如 sandbox/mode、approval/policy、permission/preset、workspace/changes、llm/retry、compaction/prune 等）以及已被压缩（compaction）剪除的历史事件；插件代码中未见任何敏感信息识别或脱敏处理。极易导致隐私泄露。请立即联系privacy@deepseek.com要求其删除数据和撤回同意。

The DeepSeek Harness client has the @deepseek-ai/dsh-session-log-deepseek plugin built in and enabled by default. This plugin attaches a dsh_session_log field to every official DeepSeek API request. Its content consists of incremental events from the canonical session log, and no redaction processing was found anywhere in the code. It uploaded my data as-is: a total of 16 sessions and 3,682 session-log-deepseek/delivery-accepted acceptance records; the sum of the maximum watermarks across the sessions is approximately 27,398 events. In session session-aa9dda1c-b7f4-4dfe-950d-8ed4e1c0d2a1, 9,374 of its 9,382 events fall within the uploaded watermark (maximum throughSeq 9,869; last acceptance time around 2026-09-30 01:59). The uploaded content is not limited to model inputs and outputs; it also includes metadata events that never entered model requests (such as sandbox/mode, approval/policy, permission/preset, workspace/changes, llm/retry, compaction/prune, etc.) as well as historical events that have already been pruned by compaction. No sensitive-information identification or redaction processing is present in the plugin code. This can very easily lead to privacy leaks. Please immediately contact privacy@deepseek.com to demand that they delete the data and withdraw consent.

[zqy1-1]

zcode重演？我去瞧瞧怎么个事。
哦，设置——通用里有个按钮可以关。

[HQ123-BOOP]

补充:
本插件还会上传工具调用的返回，也就是说。你的Key，AI读过，编辑过的代码。也很可能被上传

[zqy1-1]

我拿ds分析了一下，这个插件只会上传你用官方api key的会话log

[ef-umbra]

我拿ds分析了一下，这个插件只会上传你用官方api key的会话log

你指的是dsh桌面版自己配置的那个api key吗？还是在API开放平台申请的那个？