dsh-code-security

While AI code generation boosts productivity, it often introduces hidden risks such as injection vulnerabilities and hardcoded credentials that traditional review processes miss, leading to "delivery with defects." dsh-code-security serves as the final security checkpoint for AI Agents within the DeepSeek Harness ecosystem. It acts as a deterministic gatekeeper that enforces local security scanning before code is officially released, ensuring every change is verified. Its core strength lies in an incremental review mechanism that leverages git diff to scan only new code, optimizing performance while maintaining strict security. The plugin covers 40+ vulnerability categories, including injection, deserialization, weak encryption, and sensitive information leaks. By generating objective evidence like CWE codes and code snippets instead of just suggestions, and utilizing tools like secure_fix_verify, it enables a closed-loop process where Agents can automatically confirm the resolution of issues. Designed for developers and DevOps teams building automated workflows, dsh-code-security offers a flexible solution through custom policy gateways and baseline management. Teams can define specific thresholds and exclusions via .code-security.. As a lightweight tool with zero runtime dependencies, it integrates seamlessly into DeepSeek Harness environments, allowing users to leverage AI coding benefits without compromising on security standards.