This is the public contribution repository for DSH Hunt. It stores reviewable, public plugin metadata and community feedback; it does not mirror the closed-source application or its private data. Use it for:
- plugin submissions;
- evidence corrections;
- false-positive appeals;
- methodology feedback; and
- the public roadmap.
Maintainers can add reviewed plugin records under data/plugins/ by pull
request. Contributors who do not use Git can start with the public Issue forms.
Every record is reviewed, normalized, deduplicated, and checked by the DSH Hunt
publication process before it can appear on the website. A merged contribution
does not publish a listing automatically.
Official website: https://dshhunt.com
A package record describes public repository structure at a fixed source commit. It may include the package and manifest path, declared metadata, Patch file links and order, source hashes, a limited YAML structure summary, and the collector's coverage. The public record does not rehost Patch contents.
observed means the recorded source files were read and checked at that commit. It does not mean the package was installed, built, or run. DSH Hunt does not infer runtime compatibility or safety from these fields. partial means some declared structure was outside the collector's supported coverage; missing evidence must not be read as evidence that a field or file does not exist.
This repository does not contain DSH Hunt's closed-source product code, collection logic, or analysis rules.
DSH Hunt uses static analysis to publish evidence. Static analysis is not a security audit, and inclusion is not a security endorsement. The first release does not perform runtime compatibility testing.
DSH Hunt is an independent community project. It is not affiliated with or endorsed by DeepSeek.
No private vulnerability reporting route has been verified. Community Issues are public and must not contain vulnerability details, affected projects or files, reproduction steps, private source code, or secrets. If you only want to ask whether a private route is available, use the public safe-reporting question form and include no details about the concern. The notice is public and does not itself report or privately deliver a vulnerability.
accepted means a maintainer has reviewed a submission or correction and recorded the proposed scope. It does not mean the public site has changed; accepted evidence must still pass the release checks. published is used only after a release is live and the affected page has been checked. Maintainers update the Issue state after those steps.
Read CONTRIBUTING.md for the pull request and Issue paths: the plugin submission form, metadata update form, and broken listing report. The public fields and import boundary are described in docs/data-boundary.md.
Unless otherwise stated, the community-authored content in this repository is licensed under CC BY 4.0.
This license does not cover DSH Hunt's closed-source product code or any third-party plugin content. Third-party projects remain subject to their own licenses and terms.