dsh-security-scan

Secret & dangerous-pattern scanner for DeepSeek Harness — one security_scan tool that walks your files and reports leaked API keys, tokens, private keys, and credential-bearing connection strings. Zero runtime dependencies (pure Node built-ins).

Overview

dsh-security-scan gives the harness a model-facing security hygiene tool. Point it at a checkout (or your whole workspace) and it finds secrets that should never have been committed — then reports them redacted, so raw key material never reaches the model context or the logs.

Who is it for?

• Anyone who has ever pushed a .env or pasted a token into a config file.
• Teams that want a cheap, built-in secret gate before commits or before handing a repo to an agent.
• Developers who want a readable reference for writing a model-facing tool plugin (bare ToolDefinition, no framework).

What it detects

Kind	Pattern (examples)
AWS access key	AKIA + 16 base62 chars
GitHub token	ghp_ + 36 chars
OpenAI-style key	sk- + 20+ chars
Bearer token	generic Bearer inline credentials
Private key	-----BEGIN ... PRIVATE KEY----- blocks
DB connection string	mysql:// / postgres:// / mongodb:// with an embedded password
Dangerous file	.env with suspicious values; *.pem / *.key / *.p12 artifacts

What it does not do (yet)

• No git-history scan, no remediation, no network checks. This is a filesystem scanner, not a full security audit suite.
• No tools/pre-execute enforcement gate (planned: block writes that would re-introduce a known secret). See Development.

Compatibility

• Requires Node.js ≥ 22.19 (uses node:fs/promises and global fetch-free built-ins only).
• Built and verified against @deepseek-ai/dsh@0.1.0-rc.6 / .