Preface

In the development of DeepSeek Harness (DSH), agents need to invoke external tools. If tool parameters or returned results contain sensitive information such as secrets or tokens, directly logging them or passing them to a model can create security risks. We need a mechanism that replaces such sensitive information with placeholders without losing context, while also recording the events.

dsh-secret-scrub aims to solve this problem. It is a pattern-based scrubbing plugin that scrubs inbound parameters before tool execution, scrubs outbound results before the model sees them, and appends events to a JSONL log without storing the original plaintext.

What Is It

This is a DeepSeek Harness plugin maintained by jwilson411.

Its core function is to scrub sensitive information at the DSH tool ingress and egress boundaries based on known patterns. It is not a detection model; it does not perform classification or heuristic analysis, and it only matches predefined shapes. Logs contain only pattern names, placeholders, and statistics; they do not contain raw values, so no reverse mapping is provided.

Installation and Enablement

Install it using the official command:

dsh plugin --profile default add github:jwilson411/dsh-secret-scrub

To remove it, use the remove command.

Core Capabilities

  1. Ingress and egress scrubbing: Scrum inbound parameters before tool execution and outbound results before the model sees them.
  2. Pattern matching: Supports specific patterns such as GITHUB_PAT, AWS_ACCESS_KEY_ID, and SLACK_BOT_TOKEN.
  3. Stable placeholders: Uses the $SECRET_<PATTERN>_<8hex> format. In the same session, the same bytes generate the same placeholder, which makes model reasoning easier; placeholders differ across sessions.
  4. Preimage-free logs: Logs do not contain raw values and do not provide reverse mapping.

Usage Examples

The plugin exports functions such as wrapExecute and scrub for direct invocation.

  • Wrap tool execution:
    const execute = wrapExecute(tool.execute, state, {
      tool: tool.name,
      incidentLog: '/var/log/dsh/secret-scrub.l',
    });

This scrubs the tool parameters on entry, scrubs the tool results before they are output to the model, and appends events to the log file.
  • Scrub a value standalone:
    const { value, findings } = scrub(payload, state);
    // findings: [{ pattern: 'AWS_ACCESS_KEY_ID', placeholder: '$SECRET_…', count: 2 }]

The `scrub` function recursively traverses strings, arrays, and objects, including object keys, and returns the processed value and a list of findings.

Supported Patterns

The plugin includes built-in regular-expression matching rules for the following patterns:

  • GITHUB_PAT: Matches GitHub Classic Personal Access Tokens (ghp_ + 36 characters).
  • GITHUB_FINE_GRAINED_PAT: Matches GitHub fine-grained tokens (github_pat_ + 40 or more characters).
  • AWS_ACCESS_KEY_ID: Matches AWS long-term access key IDs (AKIA + 16 characters).
  • SLACK_BOT_TOKEN: Matches Slack bot tokens (xoxb- + a numeric segment + a secret segment).
  • PEM_PRIVATE_KEY: Matches PEM private key blocks or their headers.
  • SK_LIVE_TOKEN: Matches general sk--prefixed live API tokens.

Notes

  • Non-manager: It does not store, rotate, or validate credentials. If a credential is leaked, rotate it manually.
  • Non-detector: It does not use classifiers or entropy heuristics; it only matches predefined regular expressions.
  • Dependency version: Depends on @deepseek-ai/dsh-tools ^0.1.1-rc.2.
  • License: MIT.
  • Positioning: It is side-channel logging, not DLP (Data Loss Prevention) or a real-time scanning API.

References