Security Audit Patterns for DSH Plugins

Security audit checklist

Before publishing, check:

1. No hardcoded API keys
2. No postinstall scripts that access env vars
3. Dependencies are pinned
4. License is present
5. README documents security considerations

Run the scanner

npx dsh-plugin-lint .

This mirrors the scoring engine's checks and catches common mistakes before they reach users.