wtf is deepsec?

Deepsec is a security scanning tool built by Vercel Labs that uses AI coding agents to search a codebase for vulnerabilities that are hard to catch with traditional automated tools. Rather than relying only on fixed rule based checks, it uses powerful language models set to their highest reasoning settings to actually read and reason about the code, which the project openly states can cost thousands or even tens of thousands of dollars to scan a large codebase, though its makers say customers have found that cost worthwhile for catching bugs that would otherwise sit unnoticed for a long time. You run deepsec inside your own repository and your own infrastructure, so your code is not sent to a hosted scanning service beyond whichever AI provider you configure. For big codebases, the work is split up and run in parallel across multiple worker machines, and if a scan is interrupted partway through, rerunning the same command picks up where it stopped instead of starting over. The typical workflow has several stages: a fast pass using pattern based matchers to find candidate spots worth investigating, followed by an AI powered investigation step that produces actual findings with recommendations, an optional cheaper triage pass that sorts findings by severity, and a revalidation step that rechecks old findings against your project's git history to see if they have already been fixed. Results can be exported as markdown files or JSON for further use, and there is a special mode for scanning only the files changed in a pull request rather than the whole codebase. Deepsec needs access to an AI provider to work, either your own existing Claude or Codex subscription for smaller evaluation runs, or the Vercel AI Gateway for full scans that need more capacity. For very large projects it can also distribute the AI investigation work across cloud based sandbox virtual machines through a Vercel account. The project describes itself candidly as similar to a coding agent with full shell access on wherever it runs, and it documents the security tradeoffs of that design, including how sandboxed execution limits what a compromised dependency could actually reach. It is released under the Apache 2.0 license.