Daily security scan
Date · 2026-09-01 (UTC — plugins first indexed that day)
Static scan · new today
rule heuristics · shape onlyTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low.
Dynamic audit · subset of new today
model reads source · no executionOnly entries static-flagged ≥ warn are audited; tier = highest finding. Of 0 new entries, 0 are out of the queue or have no conclusion yet.
No new plugins that day.
Site-wide fused risk
Static + vet fused, dynamic raises applied (raise-only); 23166 entries in total
Critical-tier plugins (266)
Static heuristic scan + manifest audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
66 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-01. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusions can raise a verdict but never exempt one. The verdict shown across the site is the stricter of the two (max of static and dynamic). This daily report reflects the static layer. As of the latest run: 1898 dynamic audit records, 1767 with a model conclusion, 258 raised above the static verdict, 0 lowered below it.
Source: dsh.so security standards · Maintained by dsh.so · Published