Security Policy & Third-Party Plugin Disclaimer

August 15, 2026 · View on GitHub

Last updated: 2026-08-16 Language: 中文 / English

一、插件安全声明（Plugin Security Disclaimer）

中文

deepDDW 集成了 DeepSeek Harness（DSH）官方插件机制——用户可通过 DSH 官方命令 （dsh plugin --profile web add <npm-package>）从 npm 官方仓库安装插件， 这也是我们推荐的唯一插件获取渠道，以最大程度避免供应链投毒风险。

郑重声明：

  1. 非 deepDDW 插件（第三方插件）的安全责任在用户：任何非 deepDDW 官方发布的插件， 包括但不限于 DSH 生态插件、社区插件、自行编写的插件，其代码安全性、数据安全性、 均由用户自行查验与承担。因第三方插件引发的数据泄露、系统损坏或其他事故， 与 deepDDW 无关，deepDDW 不承担任何责任。

  2. deepDDW 官方保障范围：deepDDW 仅对记忆体（Memory）与知识库（Knowledge Base） 的代码完整性与安全性提供保障。deepDDW 承诺：

    • 不窃取用户数据
    • 不利用用户数据
    • 不贩卖用户数据
    • 数据默认全部存储在用户自己的设备/服务器上，不出内网

  3. 建议：安装任何插件前，请查验其来源、许可证与维护状态；生产环境建议使用 DSH 官方发布的插件。

English

deepDDW integrates the official DeepSeek Harness (DSH) plugin mechanism — users can install plugins from the official npm registry via the DSH official command (dsh plugin --profile web add <npm-package>). This is the only channel we recommend for adding plugins, to minimize supply-chain poisoning risk.

Important notices:

  1. Third-party (non-deepDDW) plugins are the user's responsibility: any plugin not published by deepDDW — including DSH ecosystem plugins, community plugins, or self-written plugins — must be reviewed and accepted by the user for its security and data safety. Any data breach, system damage, or other incidents caused by third-party plugins are not the responsibility of deepDDW.

  2. What deepDDW guarantees: deepDDW only guarantees the code integrity and security of the Memory and Knowledge Base components. deepDDW promises:

    • We do not steal your data
    • We do not exploit your data
    • We do not sell your data
    • By default, all data is stored on your own device/server and never leaves your LAN

  3. Recommendation: before installing any plugin, verify its source, license, and maintenance status. For production environments, prefer plugins published by the official DSH team.

二、安全报告（Reporting a Vulnerability）

中文

如您发现 deepDDW 自身（记忆体/知识库/网关）的安全漏洞，请通过 GitHub Issues（私密标注） 或项目维护邮箱与我们联系。请勿公开披露， 以便我们及时修复。

English

If you discover a security vulnerability in deepDDW itself (memory/knowledge base/gateway), please contact us via GitHub Issues (mark private) or the maintainer email. Please do not disclose publicly so we can fix it promptly.