deepsec README

The project's README from github.com/vercel-labs/deepsec. As one markdown file: README.md.

deepsec

deepsec is an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing large-scale repos.

deepsec is designed to surface hard-to-find issues that have been lurking in applications for a long time. It is configured to use the best models at maximum thinking levels (tunable via --thinking-level, see models), meaning scans can cost thousands or even tens-of-thousands of dollars for large codebases. Our customers have found the cost worth it for how quickly they were able to patch vulnerabilities that would have otherwise gone unfixed.

For large codebases, work fans out across worker machines in parallel. If a run is interrupted or errors out partway through, just re-run the same command — deepsec picks up where it left off, skipping files it already analyzed and only investigating the rest.

Get started

From the root of the repository you want to scan:

npx deepsec init

The command guides you through everything. It asks you to pick an AI model (with benchmark scores and prices to compare) and how to pay for model usage — your own OpenAI/Anthropic API key, or Vercel AI Gateway — and then works unattended: it studies your codebase, scans it, and runs the AI review. The only thing it adds to your repository is a .deepsec/ folder where all of its state and findings live.

If the run is interrupted for any reason — Ctrl-C, lost connection, a spending limit — run npx deepsec init again and it continues where it left off. To cap what a run may spend or how long it may take:

npx deepsec init --max-cost-usd 100 --max-duration 2h

When the scan finishes, get a readable report:

cd .deepsec
pnpm deepsec export --format md-dir --out ./findings

For later scans, work from inside .deepsec/:

pnpm deepsec scan        # fast pattern scan, free
pnpm deepsec process     # AI review of new candidates
pnpm deepsec revalidate  # optional, cuts false-positive rate
pnpm deepsec export --format md-dir --out ./findings

The getting started guide covers all of this in more detail, including using your own OpenAI or Anthropic API key and running from CI or a coding agent.

Docs

After initialization, agents can read the exact documentation matching the installed CLI at .deepsec/node_modules/deepsec/SKILL.md and .deepsec/node_modules/deepsec/dist/docs/. Setup errors expose these as absolute machine-readable paths.

AI provider

By default, deepsec routes model calls through Vercel AI Gateway, which gives access to every major model without provider-specific keys. You can instead bring your own key — OpenAI, Anthropic, or a custom HTTPS provider — by passing --model-auth direct with --ai-provider and --ai-api-key-env to init; no Vercel account is needed in that mode. Deepsec only ever stores the name of the environment variable holding your key, never the key itself. See project link and credentials for the full reference.

If a process or revalidate run halts because the upstream credential ran out of quota or credits, deepsec stops gracefully and tells you where to top up. Re-run the same command afterward and it picks up where it left off.

Distributed execution (optional)

Large monorepos can fan work across Vercel Sandbox microVMs:

pnpm deepsec sandbox process --project-id my-app --sandboxes 10 --concurrency 4

Setup already verified the Vercel connection, so this needs no extra onboarding. The local working tree is tarballed and uploaded; .git is excluded. Model credentials remain host-side and are injected only at the selected egress host.

Security model of deepsec itself

Treat deepsec like a coding agent with full shell access on the enviroment that it is running on. It is designed to run on trusted inputs (your source code) but you may still be concerned about prompt injection due to external dependencies or vendored code.

Running on a sandbox (see above) does limit the potential exposure substantially:

Workflow reference

Command What it does
scan Find candidate sites with regex matchers (fast, no AI)
process AI investigation; emits findings + recommendation
process --diff PR-mode: scan + investigate only files changed in a diff
triage Lightweight P0/P1/P2 classification (cheaper model)
revalidate Re-check existing findings; checks git history for fixes
enrich Add git committer info + (with a plugin) ownership data
report Markdown + JSON summary for one project
export Per-finding JSON or directory of markdown files
metrics Cross-project counts: severities, vulns by type, TPs
status Snapshot of the project mirror
sandbox <cmd> Run any of the above on Vercel Sandbox microVMs

License

Apache 2.0. See LICENSE and NOTICE.

deepsec (vercel-labs/deepsec)

Searching Database…

8.2K ·GitHub
Deepsec
这是什么？Deepsec 是一款由智能体驱动的漏洞扫描工具，你可以在自己的基础设施中运行它，按需对整个大型代码库进行安全审查，找出那些潜伏已久、很难发现的问题。
这是我要导入的库，还是我要运行的命令行工具？它是一个通过 npx 调用的命令行工具，而不是要在代码里导入的库；它会把所有状态和扫描结果写入你仓库中的 .deepsec/ 文件夹。
我第一次扫描该怎么操作？在你想扫描的仓库根目录下运行 'npx deepsec init'。它会引导你选择 AI 模型和付款方式，之后无人值守地进行扫描，并把所有状态保存在 .deepsec/ 文件夹中。
我需要自己的 OpenAI 或 Anthropic API 密钥吗？不一定。默认情况下，deepsec 会通过 Vercel AI Gateway 转发模型调用，无需特定服务商的密钥即可使用所有主流模型。你也可以改用自己的 OpenAI、Anthropic 或自定义 HTTPS 密钥，方法是使用 --model-auth direct。
一次扫描的费用可能有多高？Deepsec 默认配置为使用最强的模型并开启最高的思考强度，因此对大型代码库进行一次完整扫描，模型调用费用可能高达数千甚至数万美元。
这个工具是为谁设计的？它是为工程或安全团队设计的，这些团队需要审计庞大的现有代码库，查找长期存在的漏洞，并且愿意为此支付大量的 AI 模型使用费用。
被扫描的恶意代码能否通过提示词注入窃取我的 API 密钥？Deepsec 与编程智能体一样拥有完整的 shell 访问权限，因此第三方依赖代码或外部代码可能尝试进行提示词注入。不过，在沙箱中运行可以限制暴露范围：编程智能体的 API 密钥会在沙箱外注入，工作进程沙箱只能通过网络访问编程智能体的主机。
如果扫描中途被打断会怎样？如果运行因为按下 Ctrl-C、连接断开或达到消费上限而停止，重新运行同一条命令即可继续，会跳过已经分析过的文件，只检查剩下的部分。
Deepsec 如何处理超大型单体仓库（monorepo）？任务会分配到多台工作机器上执行，也可以选择在 Vercel Sandbox 微虚拟机上运行。此时，你本地的工作目录（不含 .git）会被打包成 tar 包并上传，以便并行分析。
Deepsec 的工作流程包含哪些命令？除了 scan（快速正则匹配）和 process（AI 调查）之外，还包括：triage（低成本的严重程度分级）、revalidate（对照 git 历史重新检查旧的发现）、enrich（补充归属信息），以及 report、export、metrics（汇总结果）。
What are similar projects?strix, Airsec, 0, qwen-code, open-swe, codex-security, mantis, open-code-review
Which topics is it in?vulnerability-scanner, code-review, static-analysis, sandbox, ci, security-tools, anthropic, cloud, coding-agent, ai-agent, openai, agent
Creator
vercel-labs
Size
1.7 MB
Stars
8.2K
Updated
CommitSep 29
Age
5mo
Commits · 90 Days