#66th of 7 in Code review and testing

deepsec

Agent-driven vulnerability scanner for reviewing all code in large existing repos

Documentation ↗ Website ↗ Repository on GitHub ↗

Stars: 8.2k
License: Apache-2.0
Last commit: Sep 2026
Language: TypeScript

Missed the latest GitHub check; these facts may be older.

Vercel is hiring: 90 open roles

Overview

deepsec runs regex matchers to find candidate sites in a repository, then has AI coding agents investigate each one and emit findings with recommendations. State lives in a `.deepsec/` folder, runs resume after interruption, and large repos can fan out across Vercel Sandbox microVMs. It supports a PR-mode diff review, revalidation of past findings, and export to JSON or markdown.

Who it is for: Security and platform engineers auditing large codebases for vulnerabilities

Strengths

Interrupted runs resume and skip files already analyzed
Free regex scan stage before paid AI review; `process --diff` limits review to changed files
Spend and time caps via `--max-cost-usd` and `--max-duration`
Bring your own OpenAI or Anthropic key, or use Vercel AI Gateway

Weaknesses

README warns full scans of large codebases can cost thousands to tens of thousands of dollars
Runs like a coding agent with full shell access; prompt injection from dependencies is a stated risk
Distributed execution depends on Vercel Sandbox
No tagged release; installed via npx

What it needs

no GPU
Needs Node.js, pnpm, Vercel AI Gateway or OpenAI/Anthropic API key, Vercel Sandbox (optional)
Models: OpenAI, Anthropic, Vercel AI Gateway, custom HTTPS provider

Also in Code review and testing

See all 7

Also in Code review and testing
Rank	Project	Score
1	open-code-reviewCLI that reviews Git diffs with an LLM agent and line-level comments47.2k starsApache-2.0	78 out of 100
2	no-mistakesLocal git proxy that runs AI review, tests and lint before opening a PR8.8k starsMIT	72 out of 100
3	pr-agentLLM pull request reviewer that comments via /review, /describe and /improve13.4k starsMIT	67 out of 100
#4	front-end-checklistFront-end rules checklist with an MCP server for agent code review74.5k starsMIT	64 out of 100
#5	e2eAI-driven end-to-end testing framework for web and mobile apps8.4k starsApache-2.0	62 out of 100

How to choose

Check where it runs: your CI with your keys, or the vendor's service.
Try it on a real PR; how much noise it makes matters more than its feature list.
See which languages and test frameworks it supports.

Health

Releases: Not checked
Top contributor: Not checked
Security advisories: Not checked
Package advisories: Not checked
OpenSSF Scorecard: Not checked

Not read for this project yet: each refresh reads the facts of a few projects. Bots and coding-agent accounts are left out of the commit counts. Not part of the score: how we check.

License in plain words

Apache-2.0 Permissive

Use it at work: Yes
Change it and rebrand it: Yes
Sell it or host it for others: Yes

Your part: Keep the notices and mark the files you change. It also grants you the contributors’ patent rights.

A plain summary, not legal advice. Read the license on GitHub ↗ (opens in a new tab)

#6 of 7 in Code review and testing on Archestack, as of 15 Oct 2026.

In your README

The badge updates twice a day.

[![Archestack](https://archestack.com/badge/vercel-labs/deepsec.svg)](https://archestack.com/best-of-vibe-coding/projects/deepsec/)

How badges work

On your site or blog

A card with the rank, score and signals, in light or dark to match the reader.

<iframe src="https://archestack.com/embed/best-of-vibe-coding/deepsec/" title="deepsec on Archestack" width="400" height="270" style="border:0;max-width:100%" loading="lazy"></iframe>

Preview the card

Best of Vibe Coding on GitHub

Each review comes from the project's README and facts we check on GitHub. The fix form opens with deepsec filled in.