Building a Faster, Cheaper Vulnerability Scanner With Jev | depthfirst

What it is

depthfirst built a vulnerability scanner on Jev, a classifier architecture that takes context, a question and a list of options and returns a probability per option instead of generating tokens. depthfirst says the scanner performs "close to GPT-5.6 Luna" at lower cost. It was evaluated on dfbench, a harness depthfirst describes as new. The page gives no accuracy figures, detection rates or false-positive rates, so "close to" is unquantified.

How it works

Jev has a 32,000-token context window, against 1 million for Luna. The harness works around this by splitting the scan into classification tasks:

1. Split the repository into small chunks. Ask Jev which are security critical or likely to contain a vulnerability, and keep the highest-probability chunks as context.
2. Scan each kept chunk in parallel, using that context, to locate potential vulnerabilities.
3. Ask a series of true/false questions to get the CWE type, the attack pattern, and the path of untrusted input: where attacker-controlled input enters, where it causes harm, the flawed check, and the likely impact.

Each CWE is a separate independent question, so all can run in parallel with the shared context cached.

Cost and speed (as stated by depthfirst)

The page says scans cost "cents".

Caveats

• The scanner only answers questions the harness authors thought to ask, so it cannot notice unanticipated issue classes.
• It does not handle vulnerabilities that need connecting several parts of the code. depthfirst says LLMs are much better at that.
• Findings give type and attack pattern but may lack detail on the actual flaw and how to exploit it. depthfirst suggests an LLM to enrich them.

What to do

depthfirst proposes using it as a cheap first pass or triage step before a more expensive model. Its examples are scanning every package in a large dependency tree and escalating only flagged results. It also suggests pairing Jev with an LLM agent, with Jev supplying relevant context. The page does not say how to obtain or run Jev or the harness, and no code or release is linked.