dsh-data-scan: A Sensitive Data Discovery DSH plugin for DeepSeek Harness

What Does It Do?

It is a DSH plugin for DeepSeek Harness that scans code and configuration files for personal data such as national ID numbers, bank card numbers, phone numbers and email addresses. It targets the common accident where real user data is dropped into a test file for debugging, committed, and later becomes searchable once the repository goes public, turning a few seconds of checking into a routine step before you commit. Unlike plain regex scanning, it applies structural checks plus checksum validation to high-risk types, which keeps false positives low. It is maintained by feely0208 under the MIT license and was last updated on 2026-10-13.

Core Features

• National ID detection: validates the weighted check digit defined by GB 11643-1999, so numbers with a wrong check digit are not reported.
• Bank card detection: uses the Luhn algorithm, so changing any single digit makes the number fail validation and stay unreported.
• Phone number detection: combines number-segment rules with boundary assertions, filtering out digit strings that merely look like phone numbers.
• Email hints: structural matching produces low-severity hints for human review.
• Severity tiers: findings are graded high, medium and low so you can triage the most sensitive hits first.
• Masked output: reports contain only file and line, type and a masked fragment, never the original value, so the scanner itself does not become a leak source.

How to Use This Plugin?

After enabling it in DSH, run a scan against the current directory to get findings; use the demo mode to preview what detections look like, or generate an HTML report when you need a record. Results are presented as file and line, type and a masked fragment, sorted by severity, so you can go back to each location and replace or remove the real data. Keep its boundaries in mind: it does not scan binaries or images, so ID cards in screenshots or tables inside PDFs are missed, and it does not inspect version history, seeing only the current working tree, which means already committed content needs separate history cleanup. It does not overlap with secret-scanning tools, one covers keys and the other covers personal information, so they work well together.

How to Troubleshoot This Plugin?

If a finding appears for data you are sure is not sensitive, first check whether it passed validation: national IDs use the weighted check digit and bank cards use Luhn, and anything failing validation is not reported, so if it still shows up, verify the rule version against the official documentation. If sensitive data clearly exists but nothing is detected, the file type is usually outside the covered scope, since binaries, images and committed history are not scanned and need to be handled another way.