dsh-security

Running code security audits inside DeepSeek Harness has historically meant either wiring up an OpenAI model alongside a Python runbook or settling for a shallow lint pass. dsh-security rebuilds the codex-security discovery-to-verification-to-report methodology entirely in pure JavaScript workflows on DSH-native tooling: no Python, no Docker, no vector service, no SQLite. Every deterministic hash, SARIF generation, and seal validation lives as a pure function inside the orchestration scripts, and all persistence is local JSONL. The audit semantics are complete: standard single-pass scanning, multi-pass deep scanning, diff-range change auditing, threat modelling, severity re-classification, SARIF 2.1.0 output, and scan-manifest hash sealing are all in scope.

Each candidate finding is independently re-validated by a fresh subagent that receives only the raw code excerpt and never inherits the discover-phase reasoning, eliminating self-review bias at the source. Deduplication runs a two-stage same-model review: a coarse FNV-1a 64 fingerprint pass against local JSONL history followed by a deep confirmation in an isolated context with transitive-closure group merging. Cross-scan history recall is bounded and configurable. The fix pipeline splits into fix (minimal source change) and verify-fix (independent re-read validation); external alerts can be triaged and ingested after independent re-check; and confirmed findings can be dispatched to GitHub, Linear, Jira, or degraded to a local export.

It is aimed at developers and security engineers working inside the DSH ecosystem who need repository or PR-level security audits without bringing in OpenAI API keys, a Python runtime, or a database stack. If you already run DSH for daily sessions, dsh-security slots in as a lightweight skill-plus-workflow bundle: a single phrase kicks off the full pipeline, all artifacts land in an isolated output directory, and the results are traceable, sealable, and reusable at any time.