dsh-alert-relay: An Alert Path Audit Plugin for DeepSeek Harness
feely0208/dsh-alert-relay
An alert-egress audit plugin for DeepSeek Harness: it checks whether alerts are configured, where they are sent, and whether sensitive data leaks into them, suggesting summary-plus-trace-id fixes.
dsh-alert-relay is an alert path audit plugin for DeepSeek Harness that answers three questions: whether alerting exists, where alerts are sent, and whether sensitive data travels with them. It targets a common reality where the alert channel becomes the least controlled exit in a system, since anyone holding a webhook URL can post to it. By statically inspecting configuration and code, it surfaces risky patterns such as stuffing error stacks, full request bodies, or user data into alerts and sending webhooks over plain http, and it supports rule listing, HTML report export, and a demo mode. It is maintained by feely0208 under the MIT license.
How to Install
dsh plugin --profile web add @deepwhale-cn/dsh-alert-relay- Category
- Development & Operations
- Platform
- DSH Plugin
- Author
- feely0208
- Distribution
- Plugin
dsh-alert-relay Key Features
dsh-alert-relay Repo Summary
What Does It Do?
Alert Relay is a DSH plugin for DeepSeek Harness that audits your alerting path and answers three questions: is there any alerting at all, where do alerts go, and is sensitive data being shipped along with them. It targets a common reality: the alert channel is often the least controlled exit in a system, since a database sits behind an intranet with auditing and access control while a webhook URL can be used by anyone who obtains it. The plugin statically inspects configuration and code to surface risky patterns such as stuffing error stacks, full request bodies, or user data into alerts. It is maintained by feely0208 under the MIT license and was last updated in 2026-10.
Core Features
- High-severity checks: flags alert payloads that carry sensitive information and webhooks sent over plain http://.
- Medium-severity checks: detects alert URLs containing keys being written into logs, and projects where no alert configuration can be found at all.
- Rule listing: prints the full set of active checks so you can confirm what the audit covers.
- Report export: generates an HTML report you can hand to your team or archive.
- Demo mode: runs a demonstration so you can see the results before pointing it at a real project.
- Clear boundaries: it only inspects configuration and code, does not verify that alerts actually get delivered, and complements log-retention tooling rather than replacing it.
How to Use This Plugin?
After enabling it in DSH, run the check against your target project to get a risk list for the alerting path; use demo mode to preview results, list the rules to confirm coverage, and export an HTML report when you need to share or archive findings.
Act on the results by following the summary-plus-trace-id principle: replace patterns like post(webhook, { text: err.stack + JSON.stringify(req.body) }) with a short [ERROR] trace=xxx message and keep the details somewhere access-controlled. Note that a missing alert configuration is a weak signal, since deployment layers may handle alerting centrally, and the plugin does not verify that alerts can actually be sent.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: feely0208/dsh-alert-relay. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.