Deepsec is an open-source security harness from Vercel Labs that uses coding agents to hunt for vulnerabilities across an entire codebase, designed for on-demand deep review of large, long-lived repositories. It has earned more than 8,200 stars on GitHub since release and is actively developed, with updates in 2026. Its site is deepsec.sh.
Deepsec is an agent-powered vulnerability scanner that you run in your own infrastructure, optimized to perform on-demand review of all code in existing large-scale repos. Instead of pattern-matching rules, it dispatches coding agents configured to use the best models at maximum thinking levels (tunable via a thinking-level flag) to actually read and reason about your code, which helps it surface hard-to-find issues that have been lurking in applications for a long time. For large codebases, work fans out across worker machines in parallel. Runs are resumable: if a scan is interrupted or errors partway through, you simply re-run the same command and Deepsec picks up where it left off, skipping files it already analyzed. The maintainers are candid that deep scans on huge repos can consume significant model tokens, a trade-off their users accept for finding bugs static tools miss.
Deepsec is free and open source under the Apache-2.0 license, released by Vercel Labs. The tool itself costs nothing; your real expense is model API usage, since deep scans with maximum thinking on large repositories can be token-intensive. There is no subscription or per-seat fee.
Deepsec is for security engineers and platform teams responsible for large or legacy codebases, especially before audits, launches, or compliance reviews. If traditional static analysis has plateaued and you want an agent to actually read the code the way a human reviewer would, Deepsec is built for that pass.