DSH Security Guard: Runtime Security Guard Plugin for DeepSeek Harness
This is a DeepSeek Harness (DSH) runtime security guard plugin maintained by ruanhaodong-tt. Through runtime method masking and HTTP request interception, it mitigates risks such as arbitrary code execution in configuration loaders and HTTP Host header spoofing without modifying source code, covering CVE QVD-2026-52631 and QVD-2026-57410. Core features include restricting Loader imports to prevent path traversal and validating the Host header to prevent loopback spoofing. Users must add the core loader and web server components to `cordis.patch.yml` and configure `trustedHosts` to allow specific access. Note that this plugin cannot fix VM.
Read Moredsh-guardwall: Runtime Safety Guardrails for DeepSeek Harness
`dsh-guardwall` is a security plugin for DeepSeek Harness (DSH), designed to protect the plugin ecosystem with a two-layer defense mechanism. Before installation, it performs a health check on plugins using static scanning, permission manifests, and trust scoring; at runtime, it blocks high-risk operations such as destructive commands, credential leakage, SSRF, and reverse shells without relying on third-party dependencies. Additionally, the plugin supports hot-loading of rules and uses HMAC chained hashing to ensure the integrity of audit logs, providing end-to-end security assurance for the Agent execution environment.
Read More