dsh-showcase processes potentially sensitive agent transcripts. Its primary security boundary is local, non-executing conversion.
- No network request is made by the runtime.
- No AI model or API is called.
- Session tools, commands, code, and attachments are never executed.
- ZIP content is read in memory and is not extracted to disk.
- Request headers and reasoning content are excluded from scene selection.
- User-derived text is XML-escaped before SVG rendering.
- Generated filenames are fixed;
--overwritenever deletes a directory. - Raw input is never copied into the output directory.
auto (default) replaces known patterns and reports counts. strict stops before rendering or writing if a pattern is detected. off emits a warning.
Current rules cover common provider keys, GitHub tokens, AWS access-key IDs, JWTs, bearer tokens, credential-like assignments, email addresses, credentialed URLs, and Windows/macOS/Linux home paths.
Pattern-based redaction cannot recognize every private value. Repository names, proprietary code, internal hostnames, personal names, business data, and novel secret formats may remain. Always inspect hero.*, poster.png, and showcase.manifest.json before publishing.
The 64 MiB compressed-input and 128 MiB decompressed-text limits reduce accidental memory exhaustion. They are not a complete hostile-archive sandbox; do not process untrusted files in a privileged environment.
Follow ../SECURITY.md. Do not attach a real private session or secret to a public issue. Use a minimal synthetic reproduction.