Security scanner for DSH plugins

Key features

• Scoring methodEach category only takes the weight of the highest severity level (critical=50 / high=30 / medium=15 / low=5). Repeated hits in the same category (such as 40 chmods) do not overlap. The summation between categories is capped at 100 - to avoid noise and filling the score.
• R011 client.mjs browser-side malicious code: DSH plug-in can inject web client code
• verified=true only means that dshbase CI can be installed, not equal to security audit.