deepsec

What is deepsec?

deepsec is Vercel's open-source harness for security reviews, aimed at auditing the code of an existing repository. You run npx deepsec init from the repo root, and it builds a threat model, maps the security-sensitive parts of the codebase, uses local pattern matchers to pick candidate files, and then sends coding agents through those code paths. A separate revalidate step re-checks the findings to cut false positives; the docs put the rate after revalidation at roughly 10 to 29 percent on high-severity results. You choose the agent backend (Codex, Claude or Pi), pick a model, and pay for model calls through Vercel AI Gateway, your own OpenAI or Anthropic key, or a locally logged-in claude or codex CLI. Large scans can fan out across Vercel Sandbox microVMs, and every stage can be resumed after an interruption. The tool itself has no license fee, but the AI review stage is billed by the model provider: with Claude Opus, the FAQ estimates $25-60 for 100 files and $500-1200 for 2,000 files.

Use cases

• Audit a repository for vulnerabilities
• Find authorization bugs across files
• Scan only changed files on pull requests
• Run scheduled weekly security scans in CI
• Re-check findings to cut false positives
• Triage and export findings as markdown or JSON

Who it's for

• Security engineers
• Application developers
• DevSecOps teams

Why use deepsec

• The pattern scan is free and local, so you only pay for AI review on the files it flags.
• Runs can be capped by cost or duration and resumed with the same command, which keeps spending predictable.
• Revalidation and triage stages help separate real issues from noise before anyone acts on them.
• Works on codebases in any language, since the AI stage reads any text source file.
• You can use your own OpenAI or Anthropic key instead of a Vercel account.

deepsec features

• Threat model and surface inventory generated at setup
• Free local pattern scan to pick candidate files
• AI investigation with Codex, Claude or Pi backends
• Revalidate step that re-checks findings for false positives
• Triage step that costs roughly 1 cent per finding
• Incremental runs that only process pending files
• Sandbox mode that fans work across Vercel Sandbox microVMs
• Export to markdown files or JSON
• Cost and time limits such as --max-cost-usd and --max-duration
• Custom matchers for languages and code patterns

deepsec integrations

• Vercel AI Gateway
• Vercel Sandbox
• OpenAI
• Anthropic
• Claude
• Codex

How to get started with deepsec

1. From the root of the repository, run npx deepsec init.
2. Pick a model and decide how to pay for model calls: AI Gateway, your own key, or a local subscription.
3. deepsec writes a .deepsec folder, builds a threat model, runs the pattern scan and starts the AI review.
4. Run revalidate to re-check high-severity findings and cut false positives.
5. Export findings with deepsec export, for example as one markdown file per finding.

deepsec limitations

• Model calls are billed by the provider and large scans can cost hundreds of dollars
• Sandbox commands need a real API token such as AI_GATEWAY_API_KEY
• Source snippets are sent to the configured model provider

deepsec pricing

deepsec is open source, so you can use and self-host it for free.

Prices can change and may vary by country or exclude tax. Check the official pricing page.

deepsec alternatives

The main deepsec alternatives listed on Debuly are Semgrep, DeepSource, Gecko Security, Nullify, Corgea and Corridor. The table compares pricing and platforms; order is A–Z.

1. 

   Corgea

   AI-native application security platform that scans code, dependencies, containers and infrastructure and proposes fixes in pull requests.

   CodingDeveloper platformsAutomation and agents
   FreemiumVisit Corgea (official site)
2. 

   Corridor

   AI code security tool that reviews pull requests and steers AI coding agents toward secure code as it is generated.

   CodingDeveloper platforms
   Free trialVisit Corridor (official site)
3. 

   DeepSource

   AI code review platform that pairs static analysis with AI review and Autofix on every pull request, with a 14-day free trial.

   CodingDeveloper platforms
   Free trialVisit DeepSource (official site)
4. 

   Gecko Security

   AI application security scanner that finds exploitable logic flaws in code, ranks them by attack path and opens fix pull requests.

   CodingDeveloper platforms
   Free trialVisit Gecko Security (official site)
5. 

   Nullify

   Autonomous product security platform that finds vulnerabilities, proves exploitability and opens merge-ready fix pull requests.

   CodingAutomation and agentsDeveloper platforms
   Contact salesVisit Nullify (official site)
6. 

   Semgrep

   Application security platform for static analysis, supply chain and secrets scanning, with AI-assisted triage and fixes for developers and coding agents.

   Developer platformsCoding
   FreemiumVisit Semgrep (official site)

deepsec FAQ

Sources & verification

Facts on this page come from the official sources below, each with the date we read it. Written by Debuly; the vendor did not review this page.

Image credits

• Logo: from assets.vercel.com · fetched 23 Oct 2026 · Vendor trademark, used only to identify the product; removed on request
• Cover: none collected yet, so a generated tile is shown.

Spot an error? Report an issue with this listing. We also remove a logo or image on the owner's request.