DeepSec — AI Security Vulnerability Harness by Vercel

Introduction

DeepSec is an open-source security harness from Vercel Labs that leverages coding agents to discover vulnerabilities in your codebase. It goes beyond static pattern matching by using LLM-powered agents to reason about code paths, identify exploit scenarios, and verify findings with contextual understanding.

What DeepSec Does

• Scans codebases for security vulnerabilities using AI coding agents
• Identifies common web vulnerabilities including XSS, SSRF, injection, and auth bypass
• Verifies findings by reasoning about code paths rather than relying solely on pattern matching
• Generates detailed vulnerability reports with reproduction steps
• Integrates into CI/CD pipelines for continuous security assessment

Architecture Overview

DeepSec is a TypeScript-based harness that orchestrates coding agents for security analysis. It first builds a code graph of the target project, identifying entry points, data flows, and trust boundaries. Agents then analyze each potential attack surface, testing hypotheses about exploitability. Findings are ranked by severity and verified through a second agent pass that attempts to construct proof-of-concept scenarios. Results are output as structured reports or CI annotations.

Self-Hosting & Configuration

• Install via npx for one-shot scans or add as a project dependency
• Configure scan scope by specifying target directories and file patterns
• Set your LLM provider API key for the agent analysis layer
• Adjust severity thresholds and false-positive filters in the config file
• Add to GitHub Actions or other CI systems for automated scanning on pull requests

Key Features

• Agent-powered vulnerability discovery that understands code context
• Multi-pass verification to reduce false positives
• Structured output with severity rankings and reproduction steps
• CI/CD integration for continuous security monitoring
• Extensible rule system for custom vulnerability patterns

Comparison with Similar Tools

• Snyk — commercial security scanning; DeepSec is open-source with deeper contextual reasoning
• Semgrep — pattern-based static analysis; DeepSec adds LLM reasoning about code paths
• Trivy — container and dependency scanning; DeepSec focuses on application-level code vulnerabilities
• Shannon — autonomous AI pentester; DeepSec is a scanning harness rather than a full pentest tool
• Prowler — cloud security assessment; DeepSec targets application source code

FAQ

Q: Does DeepSec replace traditional SAST tools? A: It complements them. Traditional tools catch known patterns efficiently, while DeepSec finds context-dependent issues they miss.

Q: Which languages does it support? A: DeepSec works with TypeScript, JavaScript, Python, and other languages supported by the underlying LLM provider.

Q: Can it run without sending code to an external API? A: You can configure it to use a local LLM provider, keeping all code processing on-premises.

Q: How long does a typical scan take? A: Scan time depends on codebase size and LLM provider latency. Small projects finish in minutes; large codebases may take longer.

Sources

• https://github.com/vercel-labs/deepsec