Skip to content

Security: KaichenCurry/dsh-design-mode

Security

SECURITY.md

Security policy

DSH Design Mode keeps provider credentials on the Host side and resolves them through the DSH credential provider only when a job starts.

Never include in an issue or commit

  • OPENAI_API_KEY, FAL_KEY, or any other provider token
  • .env files
  • .dsh/design-mode session directories
  • private source images or exported workspace archives
  • terminal logs that contain request headers or credentials

Reporting a vulnerability

Please open a GitHub security advisory for the repository instead of filing a public issue. Include a minimal reproduction that uses placeholder credentials and synthetic assets.

There aren't any published security advisories