dsh-plugin-audit

Configuration

The bundle patch inserts one row into the profile; edit it in the profile's cordis.patch.yml:

- id: dsh-plugin-audit
  name: 'dsh-plugin-audit'
  config:
    sentinelEnabled: true        # master switch; false = static audit only
    allowedHosts:                # pre-approved hosts for shell egress
      - github.com
      - api.github.com
      - raw.githubusercontent.com
      - registry.npmjs.org
      - '*.deepseek.com'         # leading *. = suffix rule (also matches the bare domain)

The static scanner takes no configuration and ignores allowedHosts — it reports every network surface it finds.