deepsec

/deepsec — scan this repository with deepsec

deepsec is an AI-powered vulnerability scanner.

• Modern AI models are great at security code review.
• Most review solutions only run on pull requests.
• That means most legacy code was never reviewed, and your code from 6 months ago was reviewed by older models.
• Instead deepsec does security review on ALL of your existing code using scaled VM fanout.
• Vercel's deepsec is open source, runs in your own infrastructure, and supports strong agent sandboxing.

A fast regex scan flags candidate files, then AI agents investigate each candidate in depth and record findings with severity ratings; findings can later be revalidated, triaged, and exported. Everything it adds to a repository lives in a single .deepsec/ workspace (config, installed package, per-project data). Because processing runs real AI agents, it costs money in proportion to how much code it investigates.

Follow this runbook when the user invokes /deepsec or asks for a scan.

1. Ask for scope first

Ask the user which scope to process, using a structured question tool if you have one (AskUserQuestion in Claude Code), otherwise plain text:

• Uncommitted changes — working tree + untracked files
• Diff to main — changes vs origin/main (use main if there is no origin remote)
• Entire codebase — warn that this is the expensive option: AI processing investigates every candidate file and can cost real money on a large repository

Ask before doing anything else so the rest of the flow can run unattended.

2. Detect onboarding state

From the repository root:

• No .deepsec/deepsec.config.ts → not onboarded. Do step 3 in full.
• .deepsec/ exists but .deepsec/node_modules/deepsec is missing, or a previous setup was interrupted → re-run the init command from step 3; it resumes from checkpoints and repairs the install rather than starting over.
• Otherwise → onboarded; skip to step 4.

3. Onboard without full processing

Onboarding normally ends with an AI processing pass over the whole repository. Since the user already chose a scope, stop setup after the coverage phase — that still includes install, login, threat model, matcher generation, and the final regex scan, but skips the full-repo AI process phase. The scoped processing happens in step 4 instead.

From the repository root, inspect the read-only plan, then run setup: