# deepsec

An agent-powered vulnerability scanner that runs in a developer's own infrastructure, using top AI models at maximum thinking effort to find hard-to-spot security issues in large codebases.

deepsec is an agent-powered vulnerability scanner meant to be run in a developer's own infrastructure, aimed at surfacing hard-to-find issues that have lingered in an application for a long time. It is configured to use the strongest available models at maximum thinking levels, which the project notes can cost thousands or tens of thousands of dollars to scan a large codebase, and states that customers have found the cost worthwhile against the vulnerabilities that would otherwise remain unfixed.

For large codebases, work fans out across worker machines in parallel, and if a scan is interrupted it resumes where it left off, skipping already-analyzed files. Running its init command walks through choosing a model, by benchmark score and price, and a payment method -- a personal API key or the Vercel AI Gateway -- then studies the codebase, scans it and runs the AI review unattended, with options to cap spend or duration.

All state and findings are kept in a project folder in the repository, and a report can be exported to Markdown files after a scan completes.

Website: https://deepsec.sh/