Security notes
Know which layer you are trusting.
This page documents the desktop shell's boundaries. DeepSeek Harness has its own permissions, credentials and sandbox behavior; consult the upstream project for those controls.
Local service exposure
The desktop app starts DSH on a loopback address and loads it locally. It does not intentionally expose the service to the LAN. Port 3080 is preferred; another available local port is selected when necessary.
What the desktop shell can access
The Go host starts a local process, opens the embedded Web UI, reads startup output and writes its own log. Project files, tools, model credentials, sessions and plugins are managed by the upstream Harness runtime rather than reimplemented by this shell.
Data locations
| Data | Owner / location |
|---|---|
| Desktop startup log | ~/.dsh-desktop/logs/dsh.log |
| Harness profiles and sessions | Managed by DSH; configurable through DSH_HOME |
| npm download cache | Application-specific cache used for the pinned DSH package |
Current signing status
Network access
The shell needs npm network access on first launch or when its package cache is empty. Model provider traffic is initiated by DeepSeek Harness according to the providers configured by the user.
Reporting a vulnerability
Do not publish sensitive exploit details in a public issue. Until a dedicated private reporting channel is configured, open a minimal GitHub issue asking the maintainer for a private contact path.
Non-affiliation
This is an unofficial community project. It is not developed, endorsed or supported by DeepSeek AI.