dsh-key-rotate: A Key Rotation Compliance Checker for DeepSeek Harness

What Does It Do?

Key Rotate is a DSH plugin for DeepSeek Harness that audits how long keys and certificates have gone unchanged, whether a rotation policy exists, and whether the same key is reused across environments. It solves the problem of policy documents claiming annual rotation while file timestamps show nothing ever changed, turning rotation status into a determinable, evidence-backed result by comparing key file modification times against a threshold. Maintained by feely0208 under the MIT license, it is written in Shell and was last updated on 2026-10-13.

Core Features

• Key and certificate age check: computes days since each file's mtime and flags anything past the default 365-day threshold as high risk.
• Missing rotation policy check: raises a medium-risk finding when no rotation strategy can be found in the documentation.
• Cross-environment reuse check: marks a medium-risk finding when the same key is referenced in multiple environment configs.
• Inspectable rules: lists every check rule together with its rationale, useful when answering compliance review and due-diligence questions.
• Report output: generates an HTML report that packages the findings into a document you can hand over directly.

How to Use This Plugin?

After enabling it in DSH, run it in demo mode to preview the findings, then point it at a real project directory to get a list of rotation issues grouped into high and medium severity. When you need deliverable material, have it emit an HTML report; when you need to explain the logic, list the rules and their basis. The plugin only performs static checks, and age does not equal non-rotation — a key may live in a KMS with only a local copy present, so reported items need your confirmation. It also does not parse certificate contents, so validity periods, issuers, and key lengths are not verified, and cross-environment reuse only covers .env-style files, leaving KMS and CI secrets out of scope. It divides work with dsh-secret-scan: that one checks whether secrets were committed, this one checks how long they have gone unchanged.

How to Troubleshoot This Plugin?

The README spells out the plugin's boundaries, which is where false positives come from: a key past the age threshold that was actually rotated in a KMS is a local-copy artifact and needs manual confirmation before you act on it. Questions about certificate validity, issuer, or key length will never be flagged because the plugin does not parse certificate contents. If cross-environment reuse is not reported, first confirm whether the key exists only in a KMS or CI secrets, since neither location is within the check scope.