Vercel unveils deepsec

Vercel Labs has unveiled deepsec, an open-source security harness that finds vulnerabilities lurking in large codebases. It runs on your own infrastructure and focuses on on-demand, in-depth investigation of aging code that per-commit static analysis tools tend to miss.

The core pipeline is as follows.

• scan: A free regex scan collects vulnerability candidates.
• process: Candidate files are grouped into batches for an AI agent to analyze along with project context.
• revalidate: Findings are re-examined, including a check of git history, and classified as TP/FP/fixed/uncertain.
• enrich/export: Committer and ownership information is added, and results are exported as JSON or Markdown.

To help the agent understand each repository's conventions and its auth/middleware structure, an INFO.md is injected into the investigation batches, and each stage uses a common FileRecord JSON so runs can be stopped and resumed or results merged. Large monorepos distribute work across Vercel Sandbox microVMs.

The AI agent supports Codex, Claude, and Pi, with default models of gpt-5.5, claude-opus-4-8, and zai/glm-5.2 respectively. Since it analyzes entire codebases with high-intensity reasoning, scan costs can run from thousands to tens of thousands of dollars, making it primarily targeted at teams operating large repositories with a security budget.