v0.18.0

DSH plugin for local security scanning of Python, Go and JavaScript/TypeScript projects. 中文说明见 README。

Install / 安装

Requires DeepSeek Harness (DSH) 0.2.1-rc.5. Other DSH versions are not verified.

dsh plugin --profile web add @shamcleren/dsh-security-scan@0.18.0

The npm package is this release's tarball. Until it is on npm, or without registry access, install from the release asset:

dsh plugin --profile web add https://github.com/shamcleren/dsh-security-scan/releases/download/v0.18.0/shamcleren-dsh-security-scan-0.18.0.tgz

For the official desktop app, replace web with your desktop profile. Restart DSH, then open 安全扫描 / Security Scan in the sidebar.

• Size: 349110 bytes
• SHA-256: 1e707b5901c31a4134f390f239ad39fa11f9e1deab1adc64eb23e4a7882ba5c1

Changes in 0.18.0

• Baselines follow the task. A task compares with its previous successful report by default; the saved-report picker is gone. The first scan is labelled as such. Each run fixes its baseline when queued, prefers complete coverage, and skips repair-branch rescans and deleted reports, so deleting the newest report now falls back to an older one. The editor shows which report the next run compares with, runs link to the report they used, and comparable runs show how many findings are new. Tasks that pinned a saved report in 0.17 migrate automatically.
• Conversation scans reuse their task per target, ref and scope, so repeated requests also compare with the previous scan. Tasks you edit in the workbench are never overwritten by a conversation. Requesting a scan that is already running returns that run.
• Repair sessions can exclude false positives with your approval. New tools dsh_security_scan_findings and dsh_security_scan_exclude_findings. The session states its evidence, DSH shows an approval prompt listing the findings, locations and reason, and the exclusion is written only when you approve. Requests outside the conversation's own reports, AI-only findings and unknown IDs are refused before prompting. Rescans then mark them excluded and the next repair round skips them.
• The repair prompt now has six steps, adding how to handle findings that are left unfixed. The report panel still allows manual exclusion after a repair starts and follows exclusions and PR links from the session.
• Install instructions now use npm with a pinned version; the pnpm used by DSH does not pick versions younger than a day otherwise.

Verification

Typecheck, build and 186 plugin tests (real Semgrep) pass; the packaged CLI passes the evaluation baseline gate, uv.lock parsing, runtime check and exclusion round trip; the isolated UI smoke test and the official Web host startup check (22 tools, 2 Skills) pass. The approval prompt is verified at the tool-policy level; clicking it in the DSH UI was not automated. Verified on macOS arm64 only. Windows and the official Electron desktop UI are not verified.

v0.17.1

DSH plugin for local security scanning of Python, Go and JavaScript/TypeScript projects. 中文说明见 README。

Install / 安装

Requires DeepSeek Harness (DSH) 0.2.1-rc.5. Other DSH versions are not verified.

dsh plugin --profile web add https://github.com/shamcleren/dsh-security-scan/releases/download/v0.17.1/shamcleren-dsh-security-scan-0.17.1.tgz

For the official desktop app, replace web with your desktop profile. Restart DSH, then open 安全扫描 / Security Scan in the sidebar. You can also paste the URL into 插件 → 添加插件, or download the tarball and install it from a local path after checking the digest:

• Size: 337890 bytes
• SHA-256: e2421177c6202ec77bd96e5a56ac9bb6927a714abcf7ac7d79de4a178ba98fbd

Changes in 0.17.1

• Scanning behavior is the same as 0.17.0.
• The README is now a short overview: features, install, first scan, network and model use, results and limits. The full reference moved to docs/guide.md and docs/guide.en.md, which also ship in the package.
• Package metadata adds publishConfig.access: public and more keywords in preparation for npm.

Verification

Typecheck, build and 183 plugin tests (real Semgrep) pass; the packaged CLI passes the evaluation baseline gate, uv.lock parsing, runtime check and exclusion round trip; the isolated UI smoke test and the official Web host startup check (20 tools, 2 Skills) pass. Verified on macOS arm64 only. Windows and the official Electron desktop UI are not verified.

v0.17.0

DSH plugin for local security scanning of Python, Go and JavaScript/TypeScript projects. 中文说明见 README。

Install / 安装

Requires DeepSeek Harness (DSH) 0.2.1-rc.5. Other DSH versions, including 0.2.2 prereleases, are not verified.

# Web profile
dsh plugin --profile web add https://github.com/shamcleren/dsh-security-scan/releases/download/v0.17.0/shamcleren-dsh-security-scan-0.17.0.tgz

# Official desktop app
dsh plugin --profile desktop add https://github.com/shamcleren/dsh-security-scan/releases/download/v0.17.0/shamcleren-dsh-security-scan-0.17.0.tgz

Restart DSH after installing, then open 安全扫描 / Security Scan in the sidebar. You can also paste the URL into the sidebar 插件 → 添加插件 page, or download the tarball and install it from a local path after checking the digest:

• Size: 333477 bytes
• SHA-256: 8d2c430ef01d56ccca961eedaf97bc19023b1514010f13f820e9d785537b444e

To upgrade, run the same command with the newer release URL. The package is not published to npm.

What it does

• Static source, secret and dependency checks with Semgrep, Gitleaks and OSV (requirements*.txt, uv.lock v1, go.sum, npm/pnpm lockfiles). These need no model tokens.
• 29 bundled rules for Flask, Django, Jinja2, Express, Koa, Next.js, React, net/http, Gin, Echo, database/sql and GORM.
• Optional read-only runtime baseline: for an HTTP(S) URL you authorize, at most 12 same-origin GET requests check security headers, cookie flags, CORS, debug pages and exposed .git / .env / pprof files. It is not a full DAST scanner.
• Optional evidence-based AI review inside DSH using your configured model.
• Offline Chinese HTML report, JSON and SARIF; baseline comparison; Git hooks and the dsh-security CLI.
• Guided repair loop: verify → minimal fix → regression test → rescan → summary, with follow-up rounds for remaining issues.
• A packaged synthetic evaluation corpus with per-case results (evaluation/).

Changes in 0.17.0

• False-positive exclusions / 误报排除. Select findings in a report, choose 标记为误报 / Mark as false positive and give a reason. Later scans hide the finding while the repository, engine, rule, file and code fingerprint still match. Excluded findings skip failure thresholds, exit codes, SARIF and AI review. Edited code, a renamed file or another repository shows the finding again. The list stays on your machine in security-scan/suppressions.json, never in the scanned repository. You can restore entries under 扫描设置 → 已排除的问题. The CLI and Git hooks use the same list: dsh-security suppress --action list|add|remove and scan --suppressions FILE | --ignore-suppressions. AI-added findings cannot be excluded.
• Framework rules / 框架规则. Rules grow from 12 to 29. New checks:
  • SQL built by f-string, %, format(), concatenation or template literals (Python, JS/TS, extended Go).
  • Server-side template source built at runtime; mark_safe / Markup; Flask debug=True; unverified JWTs.
  • Node vm, dangerouslySetInnerHTML, credentialed CORS that reflects any origin, and template.HTML.
  • Intra-function taint tracking for SSRF, path traversal and open redirect.
• Fewer false alarms. Fixed string literals passed to shell, eval, HTML and SQL sinks are no longer reported. Fixed-origin URLs, constant lookup tables, basename / secure_filename / filepath.IsLocal and Django's redirect host check count as guards.
• Evaluation. The corpus grows from 42 to 97 cases: 46 vulnerable and 51 safe. Three runs gave 41 TP / 5 FN / 2 FP / 49 TN, precision 95.3%, recall 89.1%, F1 92.1%. The original 42 cases moved from 16 / 4 / 6 / 16 to 19 / 1 / 0 / 22. The new cases were written together with the new rules, so treat their results as optimistic. Known misses stay in the corpus: missing authorization, IDOR and cross-function SSRF.
• Rule source lives in scripts/build-rules.mjs; a test keeps rules/baseline.yml in sync.

Verification

macOS arm64 with DSH 0.2.1-rc.5:

• Typecheck and 183 tests with real Semgrep.
• Release-package test: real CLI exclude → hidden → restore cycle in an isolated DSH_HOME.
• Isolated Playwright UI test covering exclusion and restore.
• Official Web startup check: 20 tools, 2 Skills.

Linux CI (Ubuntu 24.04, Node 22): install, typecheck, tests and build pass; Semgrep-dependent tests are skipped there. Windows, the desktop Electron UI, real OSV requests and an end-to-end model repair run are not verified. Third-party DAST is not included.

v0.16.1

DSH plugin for local security scanning of Python, Go and JavaScript/TypeScript projects. 中文说明见 README。

Install / 安装

Requires DeepSeek Harness (DSH) 0.2.1-rc.5. Other DSH versions, including 0.2.2 prereleases, are not verified.

# Web profile
dsh plugin --profile web add https://github.com/shamcleren/dsh-security-scan/releases/download/v0.16.1/shamcleren-dsh-security-scan-0.16.1.tgz

# Official desktop app
dsh plugin --profile desktop add https://github.com/shamcleren/dsh-security-scan/releases/download/v0.16.1/shamcleren-dsh-security-scan-0.16.1.tgz

Restart DSH after installing, then open 安全扫描 / Security Scan in the sidebar. You can also paste the URL into the sidebar 插件 → 添加插件 page, or download the tarball and install it from a local path after checking the digest:

• Size: 306397 bytes
• SHA-256: 73a3bbd90df6e6024dc76bee2379e0d82a498f3417a03164835b8cc0f1ffd29f

To upgrade, run the same command with the newer release URL. The package is not published to npm.

What it does

• Static source, secret and dependency checks with Semgrep, Gitleaks and OSV (requirements*.txt, poetry.lock, uv.lock v1, go.mod, npm/pnpm/yarn lockfiles). These need no model tokens.
• Optional read-only runtime baseline: for an HTTP(S) URL you authorize, at most 12 same-origin GET requests check security headers, cookie flags, CORS, debug pages and exposed .git / .env / pprof files. It is not a full DAST scanner.
• Optional evidence-based AI review inside DSH using your configured model.
• Offline Chinese HTML report, SARIF and Markdown; baseline comparison; Git hooks and the dsh-security CLI.
• Guided repair loop: verify → minimal fix → regression test → rescan → summary, with follow-up rounds for remaining issues.
• A packaged synthetic evaluation corpus with per-case results (evaluation/).

Changes in 0.16.1

• First standalone GitHub release. Package metadata now points to this repository; contributor setup uses the repository's own lockfile and CI.
• Documentation uses the dsh-security shortcut and the release URL install.
• Features match 0.16.0 (runtime baseline, guided repair loop, task editor and report follow-up UI).

Verification

macOS arm64 with DSH 0.2.1-rc.5: typecheck, 176 tests with real Semgrep, release-package test, isolated Playwright UI test and official Web startup check (20 tools, 2 Skills). Linux CI (Ubuntu 24.04, Node 22): install, typecheck, tests and build pass; the two Semgrep-dependent tests are skipped there. Windows, the desktop Electron UI, real OSV requests and an end-to-end model repair run are not verified.