deepsec
Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents
What is it?
What it is
deepsec is an agent‑powered vulnerability scanner designed for large codebases, enabling on‑demand reviews of all repository code with AI‑driven analysis.
Why it exists
It surfaces hard‑to‑find security issues that linger in applications, offering rapid patching at a cost that many customers find worthwhile for the speed and depth of insight it provides.
Who should use it
Large organizations, security teams, and DevOps engineers managing extensive codebases with budget for AI-driven security tools.
Who should avoid it
Small teams, individual developers without resources, or users lacking technical expertise to configure AI integrations.
How it works
A quick walkthrough in plain English
How deepsec works
Step 1 of 3
You interact with it
Open deepsec, send a request, or connect it to your stack.
Features
Advantages
- Open source (Apache-2.0)
- Active TypeScript ecosystem
- Self-hosted deployment options
Disadvantages
- Requires operational ownership for self-hosted setups
- Community support varies by project maturity
Installation
cloud
pnpm deepsec sandbox process --project-id my-app --sandboxes 10 --concurrency 4
FAQ
How does deepsec manage the cost of scans for large codebases?
Scans can be expensive due to using high-level AI models at maximum thinking levels, but the cost is justified by identifying critical vulnerabilities that might otherwise go unfixed.
What are the initial steps to set up deepsec?
Navigate to the repository root, run `npx deepsec init` to create the `.deepsec` directory, then `pnpm install` to install dependencies, and follow the instructions from the `init` output.
How does deepsec handle large repositories efficiently?
For large codebases, deepsec distributes work across parallel worker machines or Vercel Sandbox microVMs, allowing concurrent analysis and resuming interrupted scans.
Why is the Vercel AI Gateway recommended for real scans?
The Vercel AI Gateway provides higher quotas suitable for concurrent research, covering both Claude and Codex models, which is more efficient than local subscriptions for full repo scans.
How does deepsec ensure security when running with shell access?
Deepsec is designed to run on trusted inputs (your code), but when using Vercel Sandbox, network egress is limited to coding agent hosts, reducing exposure. API keys are injected externally, preventing exfiltration.
What does the `revalidate` command do?
`revalidate` re-checks existing findings against git history to detect if vulnerabilities have been fixed since the initial scan.
Featured in Videos
YouTube tutorials and walkthroughs for deepsec
Alternatives
Similar projects ranked by category, topics, and text overlap.
