[简体中文](README.md) · **English**
# Code Security
**Inspect security findings and verify the fixes.**
[](https://www.npmjs.com/package/dsh-code-security) [](https://www.npmjs.com/package/dsh-code-security) [](https://www.npmjs.com/package/dsh-code-security)
**[Install](#install) · [Workflow](#start-using-it) · [Full guide](https://github.com/STARDUSTLC666/dsh-code-security/blob/master/docs/REFERENCE.en.md)**
## Features
- Scan files, directories or a Git diff.
- Inspect locations, rules, coverage and redacted evidence.
- Recheck the same scope and export Markdown or SARIF when needed.
## Install
Open **Plugins** in the DSH desktop app and install `dsh-code-security`. If the CLI is available:
```bash
dsh plugin --profile desktop add dsh-code-security
```
For the web profile, replace `desktop` with `web`. Restart that DSH profile after installation. The package’s DSH requirement is `>=0.2.1-rc.3`.
## Start using it
1. In the target repository session, choose the whole project or current Git changes.
2. For example: “Review these changes for security issues; report concrete triggers and code evidence.”
3. Open Code security in the sidebar and inspect file locations, rules and evidence; prepare optional scanners separately.
4. Recheck the same scope after fixing it, keeping false-positive reasons and unresolved human decisions.
Example request：
> Check the current Git diff for security findings with triggers, locations and code evidence.
## Before you start
Betterleaks, Semgrep CE and OSV are optional additions; a scan does not prove the absence of vulnerabilities.
Configuration, detailed tools and troubleshooting: [full reference](https://github.com/STARDUSTLC666/dsh-code-security/blob/master/docs/REFERENCE.en.md).
## Plugin updates
Check updates at the bottom of the workbench or native plugin details. Automatic checks are on by default; **automatic installation is off**. You choose whether to install and when to restart. Suite-managed components update with their bundle. [Update behavior](https://github.com/STARDUSTLC666/dsh-code-security/blob/master/docs/REFERENCE.en.md).
## Documentation
- [Full usage, configuration and limits](https://github.com/STARDUSTLC666/dsh-code-security/blob/master/docs/REFERENCE.en.md)
- [Release notes](https://github.com/STARDUSTLC666/dsh-code-security/blob/master/CHANGELOG.md)
- [Validation scope and history](https://github.com/STARDUSTLC666/dsh-code-security/blob/master/docs/VALIDATION.md)
## Feedback and contributions
If the plugin helps, a Star makes it easier for others to discover. Report problems or suggest improvements in [Issues](https://github.com/STARDUSTLC666/dsh-code-security/issues); code and documentation [PRs](https://github.com/STARDUSTLC666/dsh-code-security/pulls) are welcome. Include versions and reproduction steps, and remove credentials from reports.
## License
[MIT](https://github.com/STARDUSTLC666/dsh-code-security/blob/master/LICENSE)
