DeepSec

What it is

DeepSec's operational and security model — the parts an engineer needs before running it, not the pitch. It runs like a coding agent with full shell access on the host, so trust boundary and credential handling matter as much as findings quality.

How it works

npx deepsec init from a repo root walks you through model choice (with benchmark scores and prices) and payment, then runs unattended. The only thing written to your repo is a .deepsec/ folder holding all state and findings. Runs are resumable: re-running the same command skips already-analyzed files. It also stops gracefully if a credential runs out of quota and tells you where to top up.

After init, subsequent scans run from inside .deepsec/ as a staged pipeline — scan (free pattern pass), process (AI review of new candidates), optional revalidate (cuts false positives), then export. These are ordered, not interchangeable.

What to do

Cap spend/time on a first run:

npx deepsec init --max-cost-usd 100 --max-duration 2h

Get a readable report:

cd .deepsec
pnpm deepsec export --format md-dir --out ./findings

Later scans, from inside .deepsec/:

pnpm deepsec scan        # fast pattern scan, free
pnpm deepsec process     # AI review of new candidates
pnpm deepsec revalidate  # optional, cuts false-positive rate
pnpm deepsec export --format md-dir --out ./findings

Fan a monorepo across Vercel Sandbox microVMs:

pnpm deepsec sandbox process --project-id my-app --sandboxes 10 --concurrency 4

To avoid a Vercel account, pass --model-auth direct with --ai-provider and --ai-api-key-env to init. DeepSec stores only the name of the env var holding your key, never the key.

Caveats

DeepSec is designed for trusted inputs (your source), but the page explicitly flags prompt-injection risk from external dependencies or vendored code, since it runs with full shell access. The sandbox mode is the mitigation, and it changes the trust boundary materially:

flowchart TD
    A[deepsec run] --> B{Sandbox mode?}
    B -->|Local host| C[Agent + API keys<br/>on same host]
    B -->|Sandbox microVM| D[Keys injected<br/>outside sandbox]
    C --> E[Injection could<br/>exfiltrate keys]
    D --> F[Keys not reachable;<br/>egress limited to<br/>agent hosts]

Note the exception the page states: egress is allowed during sandbox bootstrap, but the coding agent does not run during bootstrap. The local tree is tarballed and uploaded with .git excluded. Cost is real — the page says scans can run into thousands or tens-of-thousands of dollars for large codebases at max thinking level (tunable via --thinking-level).