jkt-check/dsh-secret-scrub
An irreversible secret-scrubbing guard: secrets are rewritten to [REDACTED:category] placeholders on their way to the session log and the model, so the durable log and the request never carry the fragment.
dsh-secret-scrub is an irreversible secret-scrubbing guard. It rewrites text on its way to the session log and the model: when a configured rule matches a secret-shaped fragment — an access key, a bearer token, a private key block — the fragment is replaced irreversibly with a [REDACTED:<category>] placeholder, so the durable log and the model request carry only the placeholder at the covered points. It ships with a default balanced scrub level and no credentials are needed; the level can be raised to aggressive and extra categories added through the profile patch, e.g. a custom internal-token pattern. The README's example verifies it by running a task containing a test AWS key and confirming the value is redacted before reaching the model/session log.
Install
dsh plugin --profile headless add dsh-secret-scrubCopied verbatim from the README's 'Use with dsh' section (the README shows headless as an example profile; substitute your own). It also shows a local tarball form and npm install dsh-secret-scrub. The package declares dsh.bundle.patch, so installation is a single command and the plugin activates at the default balanced scrub level.
Compatibility
A DSH profile plugin that mounts via the shipped cordis.patch.yml. The README notes the @deepseek-ai/dsh-* peer packages are type-only and optional. Level and custom rules are overridden in the profile patch layer (~/.dsh/profiles/<profile>/cordis.patch.yml) by overriding the secret-scrub id.
Details
- Repo: jkt-check/dsh-secret-scrub
- Category: Development & Runtime
- Stars: 2
- Version: GitHub repo jkt-check/dsh-secret-scrub; npm package dsh-secret-scrub at 0.1.2 (registry check 2026-10-08; registry repository field resolves back to this repo). Extracted from the kaya-ai-terminal project's user-sensitive-information protection strategy. Runtime peers: @deepseek-ai/cordis and @deepseek-ai/schemastery.
Alternatives
omdsh-dev/dsh-security-audit · bigclawd/dsh-security-guard · good-boy4069/dsh-vision-guard