DSH plug-in development tool

Key features

• Read-onlyNever modify/delete any files, never execute the code of the audited plug-in, and never actively connect to remote targets.
• Desensitization protocolThe suspected secret (token/key/private key/password) is immediately used as an HMAC fingerprint with an in-process random key after reading. The original value is only used for fingerprint calculation and is not entered into canonical output
• Secret desensitizationSuspected secrets only return type/length/in-process random HMAC fingerprint/path/line number, and the complete value never appears in canonical output (design-level guarantee, non-truncation)
• Path fenceAll paths are checked by lstat → realpath → containment
• root is fixed to $DSH_HOME parsed when the process is started (or allowedRoot declared by the administrator), and the model parameters cannot expand the reading range.