Introducing deepsec: The security harness for finding vulnerabilities in your codebase
By Steven Van ·
The open-source tool runs locally or fans out to more than 1,000 Vercel Sandboxes, using an existing Claude or Codex subscription for inference.
Vercel has open sourced deepsec, a security harness that uses coding agents to find vulnerabilities in large codebases. It runs entirely on your own infrastructure: a single machine is enough, with no cloud service needed for privileged source access, and it can use an existing Claude or Codex subscription for inference without extra setup.
The pipeline uses Opus 4.7 at max effort and GPT 5.5 at xhigh reasoning to investigate files flagged by an initial regex-only scan, tracing data flows and checking for mitigations before producing findings with severity ratings:
- Scan: a regex-only pass over every file to flag security-sensitive areas
- Investigate: agents examine each flagged file in detail
- Revalidate: a second agent run rechecks findings to cut false positives
- Enrich: an agent uses git metadata to identify who should fix each issue
- Export: findings are formatted into tickets for humans or coding agents
Scanning a large repository on a single machine can take multiple days, so deepsec can optionally fan work out to Vercel Sandboxes for parallel remote execution; Vercel says scans of its own codebases routinely use more than 1,000 concurrent sandboxes. To start, running npx deepsec init from a repository's root asks which model to use, from a short list of recommended model and reasoning-level combinations scored on Vercel's DeepSecBench benchmark, and how to pay: by default through Vercel AI Gateway, or with your own OpenAI or Anthropic API key without needing a Vercel account.