deepsec

Deepsec is a security scanner that pays AI agents to find vulnerabilities the way a human auditor would. You point it at your repo, the agent reads the codebase, and it reports back with the kind of bugs that pattern-match scanners miss. The scan can cost thousands of dollars on a large codebase because it runs frontier models at maximum thinking depth. Apache 2.0, by Vercel Labs.

Setup is `npx deepsec init` and a coding agent prompt to populate a project info file. From there, scans fan out across worker machines (or Vercel Sandbox microVMs for distributed runs). Jobs are idempotent, so an interrupted scan picks up where it left off. The model bill flows through Vercel AI Gateway or your own provider keys.

Solo developers: probably overkill, and the model bill scares away curiosity scans. Use Snyk's free tier or Semgrep instead. Small teams shipping high-stakes code: a one-time scan of your auth layer or payment flow is in budget and finds real bugs. Large teams with security budgets: this is what you spend $30K on instead of a security consultant.

The catch: the cost. A scan of a 100K-line monorepo with frontier models is real money. Read the FAQ before you launch one.