vercel-labs/deepsec

What it solves

It identifies hard-to-find security vulnerabilities in large-scale codebases that traditional scanners often miss. It is specifically designed to handle massive repositories by allowing the analysis to be distributed across multiple machines and resuming interrupted scans to avoid redundant costs.

How it works

Deepsec uses a multi-stage pipeline to find and verify issues:

1. Scanning: It uses fast, non-AI regex matchers to identify potential candidate sites for vulnerabilities.
2. Processing: AI agents perform a deep investigation of these candidates to determine if they are actual vulnerabilities, providing findings and recommendations.
3. Revalidation: An optional step that uses AI to re-check findings and verify if they have been fixed in the git history, reducing false positives.
4. Distributed Execution: For very large repos, it can fan out the AI review process across Vercel Sandbox microVMs to increase speed.

Who it’s for

Security engineers and developers managing large-scale repositories who need a high-confidence, AI-powered audit of their existing code.

Highlights

• Resumable Scans: Automatically skips already analyzed files when re-running interrupted commands.
• Flexible AI Integration: Supports OpenAI, Anthropic, and custom HTTPS providers, either via Vercel AI Gateway or direct API keys.
• Cost Controls: Includes flags to cap the maximum USD spend and maximum duration of a run.
• Parallel Processing: Ability to scale the AI review process across multiple worker machines or sandboxes.