vercel-labs / deepsec

# deepsec
`deepsec` is an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing 
large-scale repos.
`deepsec` is designed to surface hard-to-find issues that have been lurking in applications for a long time. It is configured to use the best models at maximum thinking levels (tunable via `--thinking-level`, see models), meaning scans can cost thousands or even tens-of-thousands of dollars for large codebases. Our customers have found the cost worth it for how quickly they were able to patch vulnerabilities that would have otherwise gone unfixed.
For large codebases, work fans out across worker machines in parallel.
If a run is interrupted or errors out partway through, just re-run the same
command — deepsec picks up where it left off, skipping files it already
analyzed and only investigating the rest.
## Get started
From the root of the repository you want to scan:
 [code] 
The command guides you through everything. It asks you to pick an AI model
(with benchmark scores and prices to compare) and how to pay for model
usage — your own OpenAI/Anthropic API key, or Vercel AI Gateway — and then
works unattended: it studies your codebase, scans it, and runs the AI
review. The only thing it adds to your repository is a `.deepsec/` folder
where all of its state and findings live.
If the run is interrupted for any reason — Ctrl-C, lost connection, a
spending limit — run `npx deepsec init` again and it continues where it
left off. To cap what a run may spend or how long it may take:
 [code] 
When the scan finishes, get a readable report:
 [code] 
For later scans, work from inside `.deepsec/`:
 [code] 
The getting started guide
covers all of this in more detail, including using your own OpenAI or
Anthropic API key and running from CI or a coding agent.
## Docs
After initialization, agents can read the exact documentation matching the
installed CLI at `.deepsec/node_modules/deepsec/SKILL.md` and
`.deepsec/node_modules/deepsec/dist/docs/`. Setup errors expose these as
absolute machine-readable paths.
- Getting started — set up and run your first scan
- Reviewing changes — `process --diff` and CI gating
- Supported technology — built-in coverage
- Generated and hand-authored matchers
- Configuration
- Plugins
- Models
- Project link and credentials
- Architecture
- Data layout
- FAQ
- Samples
- Contributing
## AI provider
By default, deepsec routes model calls through Vercel AI Gateway, which
gives access to every major model without provider-specific keys. You can
instead bring your own key — OpenAI, Anthropic, or a custom HTTPS
provider — by passing `--model-auth direct` with `--ai-provider` and
`--ai-api-key-env` to `init`; no Vercel account is needed in that mode.
Deepsec only ever stores the *name* of the environment variable holding
your key, never the key itself. See
project link and credentials
for the full reference.
If a `process` or `revalidate` run halts becau