zephaniahwang94-cmyk/dsh-auth-gate

Install

**Important correction**: `EXPOSE` alone exposes nothing, and Docker port publishing cannot normally reach a process bound only to the container's loopback interface. The risk appears only when DSH is configured/patched to bind `0.0.0.0`, or when another process inside the container proxies a container-facing port to DSH. Publishing that port without host-IP restriction (for example `-p 3080:3080`) then exposes the full Agent control plane to reachable networks.

**Root cause**: No authentication layer. The trust fence only validates request headers, not caller identity.

### Scenario 2: Reverse proxy (Nginx / Caddy)

Add zephaniahwang94-cmyk/dsh-auth-gate to your DSH config (web profile) to enable.