DSH Security Suite

English · 中文

A native security assessment suite for
DeepSeek Harness (DSH),
adapted from the architecture of
openai/codex-security (Apache-2.0).

It runs repository, diff, and deep security scans inside DSH: LLM review
subagents do the discovery (baseline auditors, focused investigators,
file-review and deep workers), while a deterministic engine produces the
evidence baseline, and every reportable finding is bound to a claim-token
validation receipt and an attack-path receipt before it can be finalized.

Quick start

npm install
npm run build
dsh plugin --profile web add /absolute/path/to/dsh-security-suite

dsh run "Run a deep security scan, validate candidates, trace attack paths, and produce a report for this workspace."

Capabilities

See the full tool surface and evidence model in
docs/evidence-contract.md.

How discovery works

• Standard (discovery: llm, default): the plugin freezes an in-scope
  worklist from scan receipts, launches one independent baseline auditor
  subagent, builds a source-backed threat map, groups review questions into
  investigation packets, and runs one focused investigator subagent per
  packet. Every candidate must cite a receipted in-scope location.
• Diff (discovery: llm, default): each changed source file is assigned
  to one restricted file-review subagent that reads it in full.
• Deep: six workers per round with distinct lenses (forward dataflow,
  backward from sinks, authorization logic, open-ended, parsers, secrets)
  review immutable 200-line regions; a semantic reducer subagent merges
  equivalent candidates across workers; saturation requires
  stopAfterNoNew consecutive zero-novelty rounds.
• Engine (discovery: engine): the deterministic rule/AST/flow engine for
  JS/TS, Python, Go, Java, C#, PHP, Ruby, C, C++, and Rust.

Discovery never auto-confirms vulnerabilities. A finding becomes reportable
only after a source-backed validation receipt and a separately claimed
attack-path receipt.

Configuration

config:
  enabled: true
  maxFiles: 500
  maxFileBytes: 262144
  deepScan:                 # deep-scan engine (codex-security semantics)
    workers: auto           # positive integer, or 'auto' (capped at 6)
    stopAfterNoNew: 6       # saturate after this many zero-novelty rounds
    maxDiscoveryRuns: 60
    maxTimeHours: 96
  knowledgeBase: []         # files/dirs of Markdown or plain text, read-only
  scanPrompt: ''            # extra instructions for every LLM discovery worker

State is placed under DSH_SECURITY_SUITE_STATE_DIR or stateDir
(default ~/.dsh-security-suite); the engine confines repository and
knowledge-base paths to the active workspace.

Documentation

• docs/evidence-contract.md — the evidence model,
  receipts, coverage semantics, and per-rule analysis boundaries
• MIGRATION.md — the codex-security capability matrix and
  migration status

Attribution

Worker prompt templates, canonical scan-contract field trees, severity policy,
and deep-scan configuration semantics are adapted from
openai/codex-security (Apache-2.0).
No third-party security-runtime source code or dependency is executed.

License

Apache-2.0.