A DeepSeek Harness (dsh) security plugin: blocks agents from reading or writing sensitive files (.env, credentials, key material), masks leaked secret-shaped values in tool results, keeps an audit journal, and exposes safe inspection tools that never print raw values.
Results are bound to the listed commit and cover only static checks run by this registry. The Evidence Score measures reviewable information; it is not a compatibility percentage or a security guarantee.