Blocks agents from reading or writing sensitive files (.env, credentials, key material), masks leaked secret-shaped values in tool results, keeps an audit journal, and exposes safe sg_* inspection tools that never print raw values.
- License
- MIT
- Added
- 2026-08-16
GitHub info
- License
- MIT
- Primary language
- TypeScript
- Last push
- Aug 17, 2026, 1:35 AM
- Maintainer
- JohnXu22786
- Added
- 2026-08-16
Install
dsh plugin --profile web add github:JohnXu22786/secret-guardREADME badge
Add this Markdown to your plugin README to link back to its listing.
[](https://dshget.com/plugins/JohnXu22786/secret-guard)Related plugins
Security & Permissionssafety-net
★ 2Destructive-command interception gate for dsh: parses shell semantics, judges risk against 41 built-in rules, and holds irreversible rm -rf, git reset --hard, and git push --force style commands at a confirmation gate.
api-relay-audit
★ 819Runs local security audits of AI API relays and LLM proxies from DeepSeek Harness, producing Markdown reports for prompt injection, model substitution signals, tool-call rewriting, error leakage, stream integrity, and profile-gated Web3 risks.
dsh-pentest
★ 324Authorized pentest mode for DeepSeek Harness — exploration chain, assets and findings with a Web view.