dsh-plugin-dit never contains a DIT API key and does not implement its own credential store. The Web onboarding sends a newly entered key only to the local DeepSeek Harness credentials.set RPC. The corresponding credentials.describe response exposes configuration and writability flags, not the stored plaintext value.

The plugin does not put API keys in its profile patch, browser local storage, analytics, or logs. Browser local storage contains only the one-time dismissal flag dsh-plugin-dit:onboarding-dismissed:v1.

DeepSeek Harness currently uses its local credentials backend by default. It stores credentials in $DSH_HOME/.credentials.yaml as plaintext protected by filesystem mode 0600. This prevents access by other ordinary users on the same machine, but it is not encryption at rest: the current OS user, root, a malicious process running as that user, or a copied backup can read it.

Users who do not want the Web onboarding to persist a key can set DIT_API_KEY in the process environment instead. Environment variables have their own exposure risks and should still be managed through an appropriate secret manager in shared or production environments.

Do not paste credentials into a GitHub issue, discussion, test log, or pull request. Report security problems privately through the repository's GitHub Security Advisory form.

If a key was exposed, revoke it in DIT immediately and create a replacement.