{ "run_id": "dylanXM--deepseek-scanner-claude-haiku-5-5-1793019609030576991", "date": "2026-10-26T13:02:17.128391+00:00", "repo": "dylanXM/deepseek-scanner", "kind": "repo", "source": "https://github.com/dylanXM/deepseek-scanner", "commit": "693fd35b76d9d66b75ffb01869bd6d910704059f", "model": "claude-haiku-5-5", "model_version": "claude-haiku-5-5", "test_version": "readme-ca496ea10bb07418d1d8f1c256c2433a55547acc0fb62d8b6d86ae33c976fbfa", "pass": true, "outcome": "pass", "time_to_working_s": 102.678508203011, "total_s": 128.09777450561523, "steps": [ "cd && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -c 6000", "echo \"CDP_URL=$CDP_URL\"; curl -s -m 10 -w '\\nHTTP %{http_code}\\n' \"$CDP_URL/json/version\" ; ls /inputs 2>/dev/null", "cd && tail -c 2300 README.md; echo ----; cat pyproject.toml | head -50; ls src/* examples tests .coldpass", "cd /tmp && python3 -m venv 2>&1 | tail -3; -V && install -q 2>&1 | tail -5; ls | grep deepseek", "cd /tmp && scan | head -60; echo \"rc=${PIPESTATUS[0]}\"", "mkdir -p && cd /tmp && scan --format json --out ; echo \"rc=$?\"; ls -la ; head -c 700 ; echo; scan --fail-on high >/dev/null; echo \"fail-on rc=$?\"", "rm -f && cd && install -q pytest ruff 2>&1 | tail -3; -q -p no:cacheprovider 2>&1 | tail -5; echo \"pytest rc=${PIPESTATUS[0]}\"; check src tests 2>&1 | tail -3; echo \"ruff rc=${PIPESTATUS[0]}\"", "cd && grep -rniE \"cron|schedul|webhook|--once|--now|while True|loop|daemon|sleep\" src/ action.yml examples/ .github/ 2>/dev/null | head -20; echo \"grep rc=$?\"; cat src/deepseek_scan/cli.py | head -80", "cd && mkdir -p .coldpass && grep -c \"# Human-readable evidence report on stdout\" README.md && grep -c \"# CI gate: exit 1 if any critical or high finding exists\" README.md && cat > .coldpass/claims.json <<'EOF'\n[\n {\"kind\":\"claim\",\"claim\":\"Human-readable evidence report on stdout\",\"source\":\"# Human-readable evidence report on stdout\",\"input\":\"tests/fixtures/positive\",\"expected\":\"Markdown evidence report header printed\",\"probe_kind\":\"cli\",\"argv\":[\"\",\"scan\",\"\"],\"stdin\":\"\",\"expected_text\":\"# DeepSeek Exposure Scan - Evidence Report\",\"cwd\":\"/tmp\"},\n {\"kind\":\"claim\",\"claim\":\"CI gate exits 1 on high or critical findings\",\"source\":\"# CI gate: exit 1 if any critical or high finding exists\",\"input\":\"tests/fixtures/positive with --fail-on high\",\"expected\":\"exit code 1 and report total 26\",\"probe_kind\":\"cli\",\"argv\":[\"\",\"scan\",\"\",\"--fail-on\",\"high\"],\"stdin\":\"\",\"expected_returncode\":1,\"expected_text\":\"| Total findings | 26 |\",\"cwd\":\"/tmp\"}\n]\nEOF\npython3 -I -m json.tool .coldpass/claims.json >/dev/null && echo claims-ok", "cd && cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"cli\",\"argv\":[\"\",\"scan\",\"\",\"--format\",\"json\",\"--out\",\"\"],\"cwd\":\"/tmp\",\"env\":{},\"expected_file\":\"\",\"expected_text\":\"\\\"total_findings\\\": 26\"}\nEOF\ncat > .coldpass/examples.json <<'EOF'\n[\n {\"kind\":\"example\",\"claim\":\"Scan the sample project and write a markdown evidence report\",\"source\":\"README.md Quick start / Example output\",\"input\":\"tests/fixtures/positive\",\"expected\":\"markdown report with 26 findings\",\"argv\":[\"\",\"scan\",\"\",\"--out\",\"\"],\"cwd\":\"/tmp\",\"env\":{},\"expected_file\":\"\",\"expected_text\":\"| Total findings | 26 |\"},\n {\"kind\":\"example\",\"claim\":\"Project test suite (README Contributing: run pytest)\",\"source\":\"README.md ## Contributing\",\"input\":\"tests/\",\"expected\":\"17 passed\",\"argv\":[\"\",\"-q\"],\"cwd\":\"\",\"env\":{},\"expected_text\":\"17 passed\"},\n {\"kind\":\"example\",\"claim\":\"Lint check (README Contributing: ruff check src tests)\",\"source\":\"README.md ## Contributing\",\"input\":\"src tests\",\"expected\":\"All checks passed!\",\"argv\":[\"\",\"check\",\"src\",\"tests\"],\"cwd\":\"\",\"env\":{},\"expected_text\":\"All checks passed!\"}\n]\nEOF\ncat > .coldpass/cycles.json <<'EOF'\n{\"detected\":false,\"reason\":\"Inspected README, pyproject.toml, src/deepseek_scan/cli.py, action.yml, examples/ and .github/: deepseek-scan is a one-shot CLI (scan ) with no cron, scheduler, loop, webhook or --once/--now trigger. Only CI workflow/action runs exist, which are not product cycles.\",\"checks\":[]}\nEOF\nfor f in probe claims examples cycles; do python3 -I -m json.tool .coldpass/$f.json >/dev/null && echo \"$f ok\"; done; ls ", "ls -la /inputs/ 2>&1 | head; cd /tmp && = python3 -I --validate --replay 2>&1 | tail -60; echo \"rc=${PIPESTATUS[0]}\"", "ls -la ; pgrep -fa deepseek-scan || echo \"no servers running\"; cd && cat > .coldpass/report.json <<'EOF'\n{\"outcome\":\"working\",\"fault_owner\":null,\"operation\":\"Scan a source tree for DeepSeek exposure indicators and write an evidence report (deepseek-scan scan , markdown to stdout or --format json --out FILE, --fail-on CI gate)\",\"operation_scope\":\"Local, read-only static scan of a directory; no network calls. Requires Python 3.10+ (ran on 3.12.3) in a venv; no third-party runtime dependencies. Tested on the bundled tests/fixtures/positive sample project. Browser endpoint CDP_URL was reachable (HTTP 200) but not used, since the product is a CLI.\",\"steps\":[\"python3 -m venv \",\" install (README 'Install', from a checkout)\",\" scan (README Quick start: stdout report, 26 findings)\",\" scan .../tests/fixtures/positive --format json --out (README Quick start JSON output)\",\" scan .../tests/fixtures/positive --fail-on high (README CI gate: exit 1 observed)\",\" install pytest ruff; pytest -q (17 passed); ruff check src tests (clean)\"],\"deviations\":[\"Used a venv at with absolute binary paths instead of a global pip install, so the guest's system Python was not modified.\",\"Installed pytest and ruff into the venv because README Contributing documents them as dev tools.\",\"Checker path: was used; /inputs/coldpass-preflight.py does not exist in this guest.\"],\"stuck_step\":null,\"main_blocker\":null,\"plain_failure\":null,\"suggested_fix\":null}\nEOF\npython3 -I -m json.tool .coldpass/report.json >/dev/null && echo report-ok", "cd /tmp && = python3 -I --validate --replay > 2>&1; echo \"rc=$?\"; python3 -I -c \"import json;d=json.load(open(''));print('valid',d.get('valid'),'problems',d.get('problems'),'replay',d.get('replay',{}).get('status'))\"" ], "stuck_step": null, "error_excerpt": null, "what_it_did": "Scan a source tree for DeepSeek exposure indicators and write an evidence report (deepseek-scan scan , markdown to stdout or --format json --out FILE, --fail-on CI gate)", "suggested_fix": null, "tokens_in": 261874, "tokens_out": 10122, "cost_usd": 0.0157911, "usage_complete": true, "checks": [ { "check": "operation", "status": "PASS", "details": { "working": true, "argv": [ "", "scan", "", "--format", "json", "--out", "" ], "kind": "cli", "returncode": 0, "stdout": "", "stderr": "deepseek-scan: 26 finding(s) in 9 file(s); report written to ", "expected_file": "", "file_checked": true, "file_excerpt": "\"total_findings\": 26,\n \"by_severity\": {\n \"critical\": 2,\n \"high\": 22,\n \"medium\": 2\n }\n },\n \"findings\": [\n {\n \"rule_id\": \"DS-001\",\n \"rule_name\": \"DeepSeek hosted API endpoint\",\n \"severity\": \"critical\",\n \"component\": {\n \"name\": \"api.deepseek.com\",\n \"type\": \"hosted-api-endpoint\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"api_endpoint\",\n \"source_file\": \"app.py\",\n \"line\": 8,\n \"snippet\": \"base_url=\\\"https://api.deepseek.com\\\",\"\n },\n \"regulatory_context\": \"Direct calls to DeepSeek-hosted API endpoints mean prompts and data are sent to infrastructure operated by the excluded vendor. References DHS Exclusion and Removal Order #2026-01 (procurement exclusion of DeepSeek products and services).\",\n \"remediation\": \"Replace the endpoint with an approved model provider. If the endpoint is only in a comment or dead code, remove it and record the removal in your evidence file.\"\n },\n {\n \"rule_id\": \"DS-009\",\n \"rule_name\": \"DeepSeek model weight file (by filename)\",\n \"severity\": \"critical\",\n \"component\": {\n \"name\": \"deepseek-r1-distill-qwen-7b.gguf\",\n \"type\": \"ai-model-weights\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"artifact_filename\",\n \"source_file\": \"models/deepseek-r1-distill-qwen-7b.gguf\",\n \"line\": null,\n \"snippet\": \"model artifact file named 'deepseek-r1-distill-qwen-7b.gguf'\"\n },\n \"regulatory_context\": \"A first-party DeepSeek weight file inside the product directory is a DeepSeek implementation artifact in the most literal sense covered by Order #2026-01.\",\n \"remediation\": \"Remove the weight file from the product and from any image or bundle that embeds it. If weights were renamed, verify provenance with metadata or fingerprint tooling (see the project roadmap) rather than filenames.\"\n },\n {\n \"rule_id\": \"DS-002\",\n \"rule_name\": \"DeepSeek API credential / configuration variable\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"DEEPSEEK_API_KEY\",\n \"type\": \"vendor-configuration\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"env_var\",\n \"source_file\": \".env.example\",\n \"line\": 2,\n \"snippet\": \"DEEPSEEK_API_KEY=sk--***REDACTED***\"\n },\n \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n },\n {\n \"rule_id\": \"DS-002\",\n \"rule_name\": \"DeepSeek API credential / configuration variable\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"DEEPSEEK_MODEL\",\n \"type\": \"vendor-configuration\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"env_var\",\n \"source_file\": \".env.example\",\n \"line\": 3,\n \"snippet\": \"DEEPSEEK_MODEL=deepseek-chat\"\n },\n \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n },\n {\n \"rule_id\": \"DS-003\",\n \"rule_name\": \"DeepSeek model identifier string\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"deepseek-chat\",\n \"type\": \"ai-model\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"model_name\",\n \"source_file\": \".env.example\",\n \"line\": 3,\n \"snippet\": \"DEEPSEEK_MODEL=deepseek-chat\"\n },\n \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n },\n {\n \"rule_id\": \"DS-003\",\n \"rule_name\": \"DeepSeek model identifier string\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"deepseek-r1\",\n \"type\": \"ai-model\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"model_name\",\n \"source_file\": \"Dockerfile\",\n \"line\": 5,\n \"snippet\": \"RUN ollama pull deepseek-r1:7b\"\n },\n \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n },\n {\n \"rule_id\": \"DS-008\",\n \"rule_name\": \"DeepSeek reference in container / deployment definition\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"deepseek\",\n \"type\": \"deployment-artifact\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"container\",\n \"source_file\": \"Dockerfile\",\n \"line\": 5,\n \"snippet\": \"RUN ollama pull deepseek-r1:7b\"\n },\n \"regulatory_context\": \"Container definitions that pull DeepSeek images or models (for example via ollama pull deepseek-*) bake the excluded vendor's models into the deployed artifact.\",\n \"remediation\": \"Swap the image or model pull for an approved model, rebuild the image, and re-scan the rebuilt definitions.\"\n },\n {\n \"rule_id\": \"DS-005\",\n \"rule_name\": \"DeepSeek SDK import\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"import deepseek\",\n \"type\": \"vendor-sdk\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"sdk_import\",\n \"source_file\": \"app.py\",\n \"line\": 3,\n \"snippet\": \"import deepseek\"\n },\n \"regulatory_context\": \"Importing a DeepSeek SDK (first-party or a client wrapper for the DeepSeek API) is direct evidence of a code-level integration with the excluded vendor's service.\",\n \"remediation\": \"Remove the SDK usage and route the affected feature through an approved provider's SDK. Check dependency manifests too (rule DS-006).\"\n },\n {\n \"rule_id\": \"DS-002\",\n \"rule_name\": \"DeepSeek API credential / configuration variable\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"DEEPSEEK_API_KEY\",\n \"type\": \"vendor-configuration\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"env_var\",\n \"source_file\": \"app.py\",\n \"line\": 7,\n \"snippet\": \"api_key=\\\"DEEPSEEK_API_KEY\\\"],\"\n },\n \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n },\n {\n \"rule_id\": \"DS-003\",\n \"rule_name\": \"DeepSeek model identifier string\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"deepseek-chat\",\n \"type\": \"ai-model\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"model_name\",\n \"source_file\": \"app.py\",\n \"line\": 13,\n \"snippet\": \"model=\\\"deepseek-chat\\\",\"\n },\n \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n },\n {\n \"rule_id\": \"DS-003\",\n \"rule_name\": \"DeepSeek model identifier string\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"deepseek-reasoner\",\n \"type\": \"ai-model\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"model_name\",\n \"source_file\": \"app.py\",\n \"line\": 20,\n \"snippet\": \"model=\\\"deepseek-reasoner\\\",\"\n },\n \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n },\n {\n \"rule_id\": \"DS-002\",\n \"rule_name\": \"DeepSeek API credential / configuration variable\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"DEEPSEEK_API_KEY\",\n \"type\": \"vendor-configuration\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"env_var\",\n \"source_file\": \"docker-compose.yml\",\n \"line\": 5,\n \"snippet\": \"- DEEPSEEK_API_KEY=sk--***REDACTED***\"\n },\n \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n },\n {\n \"rule_id\": \"DS-008\",\n \"rule_name\": \"DeepSeek reference in container / deployment definition\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"DEEPSEEK\",\n \"type\": \"deployment-artifact\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"container\",\n \"source_file\": \"docker-compose.yml\",\n \"line\": 5,\n \"snippet\": \"- DEEPSEEK_API_KEY=sk--***REDACTED***\"\n },\n \"regulatory_context\": \"Container definitions that pull DeepSeek images or models (for example via ollama pull deepseek-*) bake the excluded vendor's models into the deployed artifact.\",\n \"remediation\": \"Swap the image or model pull for an approved model, rebuild the image, and re-scan the rebuilt definitions.\"\n },\n {\n \"rule_id\": \"DS-003\",\n \"rule_name\": \"DeepSeek model identifier string\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"deepseek-r1\",\n \"type\": \"ai-model\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"model_name\",\n \"source_file\": \"docker-compose.yml\",\n \"line\": 7,\n \"snippet\": \"image: registry.example.invalid/deepseek-r1:latest\"\n },\n \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n },\n {\n \"rule_id\": \"DS-008\",\n \"rule_name\": \"DeepSeek reference in container / deployment definition\",\n \"severity\": \"high\",\n \"component\": {\n \"name\": \"deepseek\",\n \"type\": \"deployment-artifact\",\n \"vendor\": \"DeepSeek\"\n },\n \"evidence\": {\n \"type\": \"container\",\n \"source_file\": \"docker-compose.yml\",\n \"line\": 7,\n \"snippet\": \"image: registry.example.invalid/deepseek-r1:latest\"\n },\n \"regulatory_context\": \"Container definitions that pull DeepSeek images or models (for example via ollama pull deepseek-*) bake the excluded vendor's models into the deployed artifact.\",\n \"remediation\": \"Swap the image or model pull for an approved model, rebuild the image, and re-scan the rebuilt definitions.\"\n },\n {\n \"rule_id\": \"DS-010\",\n \"rule_name\": \"DeepSeek architecture", "needs_credentials": false, "needs_browser": false, "scope": "product operation" } } ], "safety": { "version": "z2x-1", "rules_version": "z2x-1", "summary": "Review signals: 8 known vulnerability.", "expected": "Reviewed as expected for a test run: attempted writes that failed, so nothing was written.", "findings": [ { "kind": "known-vulnerability", "count": 4, "note": "OSV reports a known vulnerability in this dependency version.", "location_count": 1, "path": "requests" } ], "context": [], "limitations": [ "A short run cannot establish that code is safe.", "Connections show IP addresses; proxies can hide the final hostname.", "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing." ], "static": { "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check." }, "evidence_url": "/safety/?run=dylanXM--deepseek-scanner-claude-haiku-5-5-1793019609030576991", "evidence_file": "/data/safety/dylanXM--deepseek-scanner-claude-haiku-5-5-1793019609030576991.json.gz" }, "agent_execution": "native_agent", "agent_runtime": "claude-code", "agent_runtime_version": "2.1.310 (Claude Code)", "tool_transport": "mcp-assigned-vm", "platform": "linux", "reasoning": "low", "service_tier": null, "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "native_tool_calls": 13, "native_bundle": null, "architecture": null, "backend": "hyperv", "platform_details": { "backend": "hyperv", "os": "linux" }, "platform_conflicts": null, "sandbox_source": null, "source_pin": { "commit": "693fd35b76d9d66b75ffb01869bd6d910704059f", "url": "https://github.com/dylanXM/deepseek-scanner" }, "purpose": "initial", "profile": { "model": "claude-haiku-5-5", "reasoning": "low" }, "fault": { "owner": null, "status": "resolved", "reason": null }, "fix_id": null, "verifies_run_id": null, "hosting": null, "operation_scope": "product operation", "tool_calls": 13, "guest_setup": null, "runtime": null, "runtime_version": null, "runtime_revision": null, "source_revision": null, "evidence_version": null, "failure_origin": null, "evidence_strength": "readme_checked", "works": "yes", "install_s": null, "first_use_s": null, "mcp": "none", "needs": [], "needs_which": null, "agent_interface": [ "cli" ], "license": "Apache-2.0", "repo_url": "https://github.com/dylanXM/deepseek-scanner", "cost_to_try": "free", "hardware": null, "what_failed": null, "local_or_hosted": "both", "cycle_checks": [ { "kind": "cycle", "claim": "Scheduled or looping main behavior", "source": "repository entry points", "input": "source inspection", "expected": "identify the product trigger", "verdict": "yes", "outcome": "Inspected README, pyproject.toml, src/deepseek_scan/cli.py, action.yml, examples/ and .github/: deepseek-scan is a one-shot CLI (scan ) with no cron, scheduler, loop, webhook or --once/--now trigger. Only CI workflow/action runs exist, which are not product cycles.", "evidence": "Inspected README, pyproject.toml, src/deepseek_scan/cli.py, action.yml, examples/ and .github/: deepseek-scan is a one-shot CLI (scan ) with no cron, scheduler, loop, webhook or --once/--now trigger. Only CI workflow/action runs exist, which are not product cycles.", "command": "" } ], "claims": [ { "kind": "claim", "claim": "Human-readable evidence report on stdout", "source": "# Human-readable evidence report on stdout", "input": "tests/fixtures/positive", "expected": "Markdown evidence report header printed", "command": " scan ", "verdict": "yes", "outcome": "Real input produced the expected result: # DeepSeek Exposure Scan - Evidence Report", "evidence": "# DeepSeek Exposure Scan - Evidence Report\n\nGenerated by `deepseek-scan` (tool v0.1.0, rules v2026.10.22.1).\n\n| Field | Value |\n|---|---|\n| Scan target | ` |\n| Timestamp (UTC) | 2026-10-26T13:02:10Z |\n| Files scanned | 9 |\n| Total findings | 26 |\n\nThis report lists indicators of DeepSeek components found in the scanned tree, with file-and-line evidence, so the results can be handed to an engineering, security or contracts team for review and remediation. Read the **Detection limits** section before drawing conclusions from it.\n\n## Summary by seve", "returncode": 0, "source_checked": true, "source_file": "README.md" }, { "kind": "claim", "claim": "CI gate exits 1 on high or critical findings", "source": "# CI gate: exit 1 if any critical or high finding exists", "input": "tests/fixtures/positive with --fail-on high", "expected": "exit code 1 and report total 26", "command": " scan --fail-on high", "verdict": "yes", "outcome": "Real input produced the expected result: | Total findings | 26 |", "evidence": "| Total findings | 26 |\n\nThis report lists indicators of DeepSeek components found in the scanned tree, with file-and-line evidence, so the results can be handed to an engineering, security or contracts team for review and remediation. Read the **Detection limits** section before drawing conclusions from it.\n\n## Summary by severity\n\n| Severity | Findings |\n|---|---|\n| critical | 2 |\n| high | 22 |\n| medium | 2 |\n\n## Findings\n\n### Critical\n\n#### DeepSeek hosted API endpoint (DS-001)\n\n- Location: `app.py:8`\n- Component: api.deepseek.com (hosted-api-endpoint)\n- Evidence type: api_endpoint\n\n```\nbas", "returncode": 1, "source_checked": true, "source_file": "README.md" } ], "claims_note": null, "example_checks": [ { "kind": "example", "claim": "Scan the sample project and write a markdown evidence report", "source": "README.md Quick start / Example output", "input": "tests/fixtures/positive", "command": " scan --out ", "evidence": "t gateway's own domains and model names; or any use that leaves no artifact in the scanned tree.\n\nA report with findings is evidence that the listed indicators are present at the listed locations. A report without findings means only that none of the indicators in the current rule set were found in the scanned tree; it is not proof that no DeepSeek-derived component exists in a product. Determinations about obligations under DHS Exclusion and Removal Order #2026-01 or FAR 52.204-30 rest with each organization and its counsel. This tool is an evidence-collection aid, not a legal determination.\n", "deferred": false, "expected": "markdown report with 26 findings", "returncode": 0, "verdict": "yes", "outcome": "command completed successfully" }, { "kind": "example", "claim": "Project test suite (README Contributing: run pytest)", "source": "README.md ## Contributing", "input": "tests/", "command": " -q", "evidence": "................. [100%]\n17 passed in 0.44s", "deferred": false, "expected": "17 passed", "returncode": 0, "verdict": "yes", "outcome": "command completed successfully" }, { "kind": "example", "claim": "Lint check (README Contributing: ruff check src tests)", "source": "README.md ## Contributing", "input": "src tests", "command": " check src tests", "evidence": "All checks passed!", "deferred": false, "expected": "All checks passed!", "returncode": 0, "verdict": "yes", "outcome": "command completed successfully" } ], "does_what_it_says": "yes", "maintenance": { "last_commit_at": "2026-10-23T08:14:49Z", "commits_90d": 2, "merged_prs_90d": 0, "open_issues": 0, "open_prs": 0, "reply_share": null, "reply_threads": 0, "median_reply_hours": null, "last_release_at": null, "archived": false, "verdict": "maintained", "note": "actively maintained: last commit 3 days ago; 2 commits and 0 merged PRs in 90 days; 0 open issues, 0 open PRs; no releases" }, "maintenance_verdict": "maintained", "maintenance_note": "actively maintained: last commit 3 days ago; 2 commits and 0 merged PRs in 90 days; 0 open issues, 0 open PRs; no releases", "maintained": "active", "maintained_note": "last commit 3 days ago", "last_commit_at": "2026-10-23T08:14:54Z", "last_release_at": null, "open_issues": null, "answered_issues": null, "platforms_claimed": [ "linux" ], "topic": "other", "agent_interfaces": [ { "interface": "cli", "evidence": "independent checker", "observed": true, "operation_checked": true }, { "interface": "api", "evidence": "README metadata", "observed": false, "operation_checked": false } ], "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.", "mcp_context": null, "tested_at": "2026-10-26T13:02:17.128391+00:00", "tested_commit": "693fd35b76d9d66b75ffb01869bd6d910704059f", "tested_with": { "agent": "claude-code", "agent_version": "2.1.310 (Claude Code)", "model": "claude-haiku-5-5", "model_route": "claude-haiku-5-5", "reasoning": "low", "os": "linux", "backend": "hyperv", "transport": "mcp-assigned-vm" }, "setup_identity": { "repo": "dylanXM/deepseek-scanner", "source": "https://github.com/dylanXM/deepseek-scanner", "commit": "693fd35b76d9d66b75ffb01869bd6d910704059f", "source_revision": null, "os": "linux", "architecture": null, "backend": "hyperv", "model": "claude-haiku-5-5", "model_version": "claude-haiku-5-5", "agent_execution": "native_agent", "agent_runtime": "claude-code", "agent_runtime_version": "2.1.310 (Claude Code)", "tool_transport": "mcp-assigned-vm", "runtime": null, "runtime_version": null, "runtime_revision": null, "sandbox_source": null, "guest_setup": null, "source_pin": { "commit": "693fd35b76d9d66b75ffb01869bd6d910704059f", "url": "https://github.com/dylanXM/deepseek-scanner" }, "platform_details": { "os": "linux", "backend": "hyperv" }, "platform_conflicts": null, "reasoning": "low", "service_tier": null, "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "operation": "Scan a source tree for DeepSeek exposure indicators and write an evidence report (deepseek-scan scan , markdown to stdout or --format json --out FILE, --fail-on CI gate)", "operation_scope": "product operation", "hosting": null, "kind": "repo", "test_version": "readme-ca496ea10bb07418d1d8f1c256c2433a55547acc0fb62d8b6d86ae33c976fbfa", "evidence_version": null }, "other_model": null, "other_run_id": null, "models_agree": null, "furthest_model": null, "transcript_url": "/transcripts/dylanXM--deepseek-scanner-claude-haiku-5-5-1793019609030576991.txt", "report_url": "/reports/dylanXM--deepseek-scanner-claude-haiku-5-5-1793019609030576991.json" }