The latest tagged prerelease is the only supported line while DSH itself is a
release candidate. Compatibility is pinned to the exact peer versions in
package.json.
Do not publish exploitable details or sensitive traces in a public issue. Use GitHub's private vulnerability reporting for this repository when available. If that surface is unavailable, contact the repository owner through GitHub without including secrets and request a private channel.
Useful reports include:
- affected Tick and DSH versions;
- operating system and Node.js version;
- minimal reproduction;
- expected and observed terminal behavior;
- whether model input, tools, audit files, or credentials were exposed.
Tick audit files contain operational metadata such as session IDs, timestamps, terminal reasons, and policy digests. DSH session traces may contain prompts, tool results, workspace paths, and provider data. Neither should be assumed safe to publish.
Never attach:
- provider or Git credentials;
- environment files;
- unreviewed session JSONL;
- private workspace contents;
- personal or third-party confidential data.
The plugin does not provide a sandbox, provider isolation, cryptographic audit ledger, or secret-redaction backend. Those remain responsibilities of the Harness and deployment environment.