dsh-plugin-security

Configuration

Change these in the settings page; they are stored in $DSH_HOME/plugin-security/state.json.

Option	Default	Behavior
Mode	report-only	off: no scans, call gate or enforcement. report-only: scan, record and gate calls; no automatic disabling. enforce: additionally auto-disable on a high-confidence malicious review.
Auto-disable threshold	critical	never turns automatic disabling off. Static matches or advisories alone never auto-disable.
Upgrade suggestions	off	Suggest upgrade commands for dependency advisories; never run silently.
Whitelist	built-in protected entries	Whitelisted plugins skip checks and the gate. This plugin, official @deepseek-ai/* packages and dsh-plugin-sentinel are always protected and cannot be disabled or uninstalled through this plugin.

State directories/files use 0700/0600 where supported; the action log keeps at most 200 entries.