Renderer escape → native code execution
The Harness window has an empty capability set: no window.__TAURI__, no IPC bridge, no file or command surface.
Security & privacy
DeepSeek Harness Desktop is a packaging layer: a Tauri 2 shell, a Rust dsh-sidecar supervisor and a bundled Node.js runtime running the official, pinned @deepseek-ai/dsh web UI without modification.
Known boundary: unsigned preview builds
v0.2.1 is not yet code-signed or notarized. Verify SHA-256 checksums and allow the app manually. Once signing is wired, CI will fail-closed if artifacts are not properly signed.
Threat model
Navigation escape → UI spoofing / session theft
The webview only allows the origin captured at readiness (same_origin navigation lock). The readiness parser accepts only the literal dsh web: http://127.0.0.1:<port> form.
Loopback port hijack by another local process
The OS assigns a random port (--port 0) and the server binds 127.0.0.1 only. The boundary is loopback + random port + a renderer with zero Node access.
Process-tree cleanup
Unix process groups plus signal handlers; Windows Job Objects (KILL_ON_JOB_CLOSE) with a hidden console. If the sidecar dies for any reason, the whole tree dies with it.
Default posture
Telemetry off by default
DSH_TELEMETRY_DISABLED=1 is injected into the child process. Any non-empty value disables upstream session telemetry.
Environment sanitization
NODE_OPTIONS, NODE_PATH, ELECTRON_RUN_AS_NODE and npm_config_* entries are filtered before spawn.
Data directory
DSH_HOME is created with mode 0700 and symlinks are rejected. It is isolated from the CLI's ~/.dsh.
Supply chain
Node downloads are SHA-256 pinned; npm install scripts are allow-listed; cargo-vet and cargo-deny gate every release.
Reporting a vulnerability
Use the GitHub Security Advisory flow on web-casa/DeepSeek-Harness-Desktop (Security tab → Report a vulnerability) for private disclosure. Include reproduction steps, platform, version and impact assessment.