dsh-security-audit

DSH local environments often concentrate API keys, tokens, session content, and plugin loading boundaries. A service listening publicly, overly permissive credential files, untrusted plugin sources, or unusual session structures can turn ordinary configuration issues into real exposure. dsh-security-audit fills that gap with a defensive, read-only auditing perspective: it does not auto-fix, does not actively connect to remote targets, and does not execute audited plugins. Instead, it brings scattered risk clues from configuration, credentials, plugins, paths, and sessions into a single reviewable report.

Its core value is redacted, reproducible, and actionable risk reporting. It reviews DSH configuration, profiles, and credential metadata for secret presence, permissions, and external endpoints; evaluates installed plugins by source, path, patch level, static dangerous capabilities, and install scripts; inspects session directory permissions, symlink escape risks, and zstd frame structure; and infers network exposure from listener configuration, URL classification, plaintext HTTP, and proxy routing. Suspected secrets are reduced to type, length, fingerprint, path, and line number, while path fencing, scan budgets, and stable ordering make the output suitable for human review rather than opaque scanning noise.

This plugin is suited for DSH administrators, local developers, security reviewers, and anyone auditing plugin provenance or exposure in DSH installations. For daily troubleshooting, it can compress questions such as “Are credentials exposed?”, “Are plugins trusted?”, “Are sessions anomalous?”, and “Is listening too broad?” into a structured report. For stricter review workflows, it provides read-only, reproducible, and non-mutating audit material without introducing another layer of operational risk.