deepsec

GitHub describes it as Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents. The repository metadata lists TypeScript as its primary language. The metadata lists the Apache-2.0 license. This article stays within the project description and details documented in the GitHub repository README.

GitHub describes it as Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents. The repository metadata lists TypeScript as its primary language. The metadata lists the Apache-2.0 license. The README describes the project this way: deepsec is an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing large-scale repos.

The README section "deepsec" states: deepsec is designed to surface hard-to-find issues that have been lurking in applications for a long time. It is configured to use the best models at maximum thinking levels (tunable via --thinking-level , see models), meaning scans can cost thousands or even tens-of-thousands of dollars for large codebases. Our customers have found the cost worth it for how quickly they were able to patch vulnerabilities that would have otherwise gone unfixed.

The README section "deepsec" states: For large codebases, work fans out across worker machines in parallel. If a run is interrupted or errors out partway through, just re-run the same command , deepsec picks up where it left off, skipping files it already analyzed and only investigating the rest.

The README section "Get started" states: The command guides you through everything. It asks you to pick an AI model (with benchmark scores and prices to compare) and how to pay for model usage , your own OpenAI/Anthropic API key, or Vercel AI Gateway , and then works unattended: it studies your codebase, scans it, and runs the AI review. The only thing it adds to your repository is a .deepsec/ folder where all of its state and findings live.

The repository README is the source for this review. It does not replace a local installation or an independent test.

• Source 1 · Project repository
• Source 2 · README