Do not open a public issue containing API keys, access tokens, cookies, passwords, private keys, session exports, raw Tool arguments, raw Tool results, or local workspace contents.
For a suspected vulnerability, use a private GitHub Security Advisory for
shine-233/dsh-plugin-debug.
If that form is unavailable, contact the maintainer account
@shine-233 privately and provide only a
minimal sanitized reproduction. Do not attach a full Profile, .env, session
database, or unredacted diagnostic bundle.
The maintainer aims to acknowledge a report within 7 calendar days and will publish a fix or a status update when the issue is confirmed. Do not expect a guaranteed SLA for unsupported preview versions or for vulnerabilities in the upstream DSH runtime; those should also be reported to the upstream project.
Only the latest published release and the current main security fixes are
actively maintained. A local candidate or an old GitHub source snapshot may
not contain security fixes. The package is currently distributed as a GitHub
source release rather than an npm registry package.
Diagnostic reports must remain metadata-only and must not include credentials, raw prompts, raw Tool arguments/results, cookies, or full local paths.