Vercel Opens Deepsec, an AI Security Scanner That Catches Bugs Static Tools Miss
Vercel open-sources deepsec, an agent-powered security harness that uses Claude and Codex to hunt vulnerabilities across large codebases on your own infrastructure
PRO- Vercel open-sourced deepsec, an agent-powered security harness that uses Claude Opus 4.7 and GPT-5.5 to find vulnerabilities in large codebases.
- Runs entirely on your own infrastructure -- no source code is sent to a third-party cloud service; works with existing Claude or Codex subscriptions.
- Five-stage pipeline: regex scan (no AI, ~15s on 2k files), AI investigation, revalidation, git-blame enrichment, and export to tickets or markdown.
- Cost ranges from $25 for 100 files to $500-$1,200 for 2,000 files; large monorepos can scale to 1,000+ concurrent Vercel Sandboxes for parallel execution.
- False positive rate is 10-20%, reduced further by the optional revalidate step; does not catch business-logic flaws or async race conditions.
- Plugin system lets teams write custom regex matchers tuned to their auth model and conventions, with a coding agent able to generate matchers automatically.
Traditional static analysis tools like Snyk and Semgrep are good at matching known patterns against a CVE database. What they miss are the bugs that live in your own abstractions: a broken auth check in a custom route handler, a server-side request forgery buried inside a server action, a data-flow edge case that only makes sense in the context of your specific codebase. Vercel just open-sourced deepsec, a security harness that uses coding agents to do the kind of careful read-through that a security engineer would do, at scale.
The problem it is solving
The timing reflects a real problem: AI-assisted coding produces changes faster than traditional security reviews can keep pace. When developers write code at human speed, security can wait until after merge. When AI writes and refactors code constantly, that model breaks down. AI-accelerated coding increases the volume of code changes, reduces developer familiarity with generated patterns, makes refactors constant, and causes security debt to quietly compound. Traditional late-stage security reviews can't keep up with this rapid pace.
Classic SAST tools often struggle between producing too many false positives or missing context-specific issues due to rigid rule-based matching. Deepsec leverages AI agents that can analyze broader code contexts across files and layers, understand intent and data flow, explain why something is exploitable in a specific codebase, and sometimes suggest semantic-preserving fixes.
How it works under the hood
At its core, deepsec uses Claude and Codex to perform tailored investigation of a codebase using Opus 4.7 at max effort and GPT 5.5 at xhigh reasoning. Scans start with static analysis to identify security-sensitive files, then coding agents investigate each candidate, tracing data flows, checking for mitigations, and producing actionable findings with severity ratings.
The pipeline has five distinct stages:
- Scan -- runs roughly 110 regex matchers across the codebase with no AI calls involved. On a 2,000-file project, it takes about 15 seconds.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
