DSH-Plugin Hub is a plugin marketplace that runs real plugin installs inside DeepSeek Harness. Security reports are taken seriously.

Only the latest published release is patched. Fixes land on main and are released as soon as they are ready.

Please do not open a public issue for a security vulnerability. Use the private channel instead:

• GitHub Security Advisory (recommended): open a "Report a vulnerability" on the repository's Security tab — https://github.com/dshplugin/dsh-plugin-hub/security/advisories/new
• Contact: reach the maintainers via GitHub Issues on the private advisory thread; for time-sensitive reports, mention [SECURITY] in the subject.

To help us triage quickly, please include:

• The affected version(s) and DeepSeek Harness version
• A short description of the vulnerability and its impact
• Steps to reproduce, or a minimal proof of concept
• Any suggested fix, if you have one

• An acknowledgement within 3 business days
• A status update and a fix plan within 7 business days
• Public disclosure after a fix is released and the reporter has been credited (unless the reporter prefers anonymity)

We ask that you refrain from public disclosure until a fix is available, so users have time to upgrade.