dsh-secret-scan: A Leaked-Secret Scanner Plugin for DeepSeek Harness

What Does It Do?

Secret Scan (dsh-secret-scan) is a DSH plugin for DeepSeek Harness that scans code repositories for leaked credentials and sensitive information before you commit, publish, or open-source. It solves the problem of API keys, tokens, and private keys slipping into version control, turning that check into a single runnable command. Maintained by feely0208 under the MIT license, it is the one general-purpose skill in the DeepWhale guard series that is not limited to any single region.

Core Features

• Seven built-in rules: covers PEM private key blocks, AWS AKIDs, GitHub tokens, Slack tokens, Stripe keys, plus high-entropy literals assigned to variables named secret, token, or password, each graded by severity.
• Masked output by default: reports keep only the first and last four characters, so evidence looks like AKIA, ghp_, or secretAccessKey and never contains the key itself.
• False-positive filtering: documented example values and obvious dummy keys containing example or dummy are filtered out, label-only format samples are not reported, and references such as process.env.SECRET are skipped.
• Exit code as verdict: a high-confidence hit returns exit code 1, so the scan can gate pre-commit hooks or CI pipelines directly.
• Remediation order over scanning: the skill stresses rotating the key first, then cleaning the code, and only then deciding whether to rewrite history, because deleting code does not invalidate a leaked key.
• Honest skip reporting: .pem, .key, and .p12 files are not read as text, and the report explicitly lists which files were skipped.

How to Use This Plugin?

After enabling it in DSH, run a scan against the target repository; output is masked by default. Add --reveal only when troubleshooting, and never store that output in a file or paste it into a chat. Use --demo to see the built-in sample and --list-rules to list every rule with its rationale. A high-confidence hit returns exit code 1, making the scan suitable for pre-commit checks or continuous integration; for medium-severity configuration warnings, review each one in context rather than abandoning the report because of noise.

How to Troubleshoot This Plugin?

If a scan comes back empty but you suspect a private key, check the file form first: .pem, .key, and .p12 files are not read as text, so dropping in server.pem will be missed, while a key named id_rsa or pasted into code or documentation will be caught, and the report lists the skipped files. If the report shows many medium-severity warnings, they are usually hardcoded assignments such as password= or token= and need to be reviewed one by one; test keys should be written as obvious fakes containing example or dummy so they are filtered automatically.