deepsec is an agent-driven vulnerability scanner that runs on your own infrastructure and is optimized for full on-demand review of existing large codebases. It is designed to find hard-to-find issues that have lurked in applications for a long time. deepsec is configured to use the best models and operate at the highest thinking level (adjustable via --thinking-level), which means that scanning a large codebase can cost thousands or even tens of thousands of dollars. Its customers consider this cost worthwhile given the ability to quickly patch vulnerabilities that might otherwise have gone unfixed.
Key capabilities and how it works
For large codebases, tasks are distributed across multiple worker machines for parallel execution. If a run is interrupted or errors out midway, simply rerun the same command, and deepsec will continue from where it left off, skipping files already analyzed and processing only the remainder.
How to use it
Run the command in the root directory of the repository you want to scan. The command will guide you through the entire process: choosing an AI model (with benchmark scores and prices provided for comparison), and choosing how to pay for model usage—using your own OpenAI/Anthropic API key, or using Vercel AI Gateway. After that, it works unattended: researching your codebase, performing the scan, and running AI review. The only addition it makes to your repository is a .deepsec/ folder, where all state and findings are stored.
If a run is interrupted for any reason—such as Ctrl-C, connection loss, or reaching a spending limit—run npx deepsec init again to continue from where it left off. You can limit the spending cap or runtime for a single run.
After the scan is complete, readable reports can be obtained. Subsequent scans take place within the .deepsec/ directory. The getting started guide covers these topics in detail, including using your own OpenAI or Anthropic API key, and running from CI or a coding agent.
After initialization, the agent can read the exact documentation matching the installed CLI, located at .deepsec/node_modules/deepsec/SKILL.md and .deepsec/node_modules/deepsec/dist/docs/. Setup errors expose these locations in a machine-readable form with absolute paths.
Project links and credentials
By default, deepsec uses the Vercel AI Gateway routing model invocation, allowing access to all mainstream models without provider-specific keys. You can also bring your own key—OpenAI, Anthropic, or a custom HTTPS provider—by passing --model-auth direct along with --ai-provider and --ai-api-key-env at init time; this mode requires no Vercel account. deepsec only stores the name of the environment variable holding the key, never the key itself. See the project links and the credentials documentation for the full reference.
If a process or revalidate run stops due to exhausted upstream credential quota or allowance, deepsec exits gracefully and tells you where to top up. After that, rerun the same command and it will continue from where it left off.
Distributed execution (optional)
Large monorepos can distribute work across Vercel Sandbox microVMs. The setup process has already verified the Vercel connection, so no additional onboarding is required. The local working tree is packaged and uploaded, with .git excluded. Model credentials remain on the host side and are injected only into the selected egress host.
deepsec's own security model
You should treat deepsec as a coding agent with full shell access on the environment where it runs. It is designed to run on trusted input (your source code), but due to external dependencies or third-party code, you may still be concerned about prompt injection.
Running on a sandbox (see above) does significantly reduce the potential exposure surface: the coding agent's API key is injected outside the sandbox and therefore cannot be stolen; for worker sandboxes, the sandbox's network egress is restricted to only the coding agent host (the bootstrapping process allows egress, but that process does not run the coding agent).
License
Apache 2.0. See LICENSE and NOTICE for details.
deepsec is a security scanning tool driven by a coding agent for discovering vulnerabilities in codebases.
