A security scanner built around investigation
Deepsec is not trying to replace a regular expression with a language model and call the result security research. Its pipeline maps the repository, detects technologies, and runs local matchers to identify candidate locations. A coding agent then reads surrounding files, traces control flow, and decides whether a candidate is a credible vulnerability.
That design targets the gap between fast static checks and a human audit. A rule can find a route handler or an unsafe API, but it often cannot tell whether middleware protects the route, whether tenant data crosses an authorization boundary, or whether a value is attacker-controlled several functions earlier. Deepsec gives the model repository tools and project context to investigate those questions.
The scanner supports more than JavaScript. Its technology guide documents coverage across TypeScript, Python, PHP, Ruby, Go, infrastructure files, and other ecosystems. Coverage is uneven. Next.js, common Python web frameworks, Rails, and several Go frameworks receive specific treatment, while dedicated matchers for many other detected stacks are still roadmap work. The agent can read any text source, but thinner rules mean less precise candidate selection.
The quick start hides an expensive second half
Running npx deepsec init is a polished entry point. It creates an isolated .deepsec workspace, asks which model and payment route to use, writes project context, scans the code, and begins investigation. You can use Vercel AI Gateway, a direct OpenAI or Anthropic key, or an existing local Codex or Claude login. Node.js 22 or newer is required.
Resumability is one of Deepsec's best operational choices. If a connection drops, a provider quota ends, or a spending cap stops processing, running the command again skips completed work. The same state supports later incremental scans. Cost and duration limits provide a needed brake, and a scaffold-only mode lets teams inspect the generated workspace before processing begins.
The real cost sits after the free pattern pass. The README warns that large codebases can consume thousands or tens of thousands of dollars in model calls. The FAQ gives an example range of $500 to $1,200 for 2,000 files with a particular Claude setup, with revalidation costing roughly as much as processing. Those are project estimates, not guarantees, but they make the buying decision clear. This is a periodic deep audit tool, not an obvious default for every small pull request. Start with a limited sample and measure your own repository.
Access is the hardest security decision
Deepsec asks for unusual trust from a security product. Its README says to treat it like a coding agent with full shell access to the environment where it runs. Repository content and vendored code can contain hostile instructions, and relevant source snippets are sent to the configured model provider. The Codex path uses constrained repository tools, while the local Claude path has broader shell behavior. The supported backends do not currently share one enforceable security contract.
An open feature request lays out the missing piece: an explicit fail-closed, read-only profile that restricts files, network access, credentials, and arbitrary host commands. That issue does not prove an exploit, but it describes why regulated teams should not point the default local flow at a laptop full of cloud credentials. Vercel Sandbox can reduce exposure and limits worker egress during agent execution, yet distributed mode uploads a tarball of the working tree and adds another boundary to assess.
Use a disposable checkout or isolated worker, remove unrelated secrets, and decide which provider may receive code before the first run. Plugins and executable TypeScript configuration also belong inside that review. Deepsec can find security flaws, but installing it does not transfer responsibility for its own operating boundary.
Results still need a skeptical reader
The project is frank about false positives. Its FAQ reports roughly 10 to 29 percent for high-severity findings after revalidation and recommends reviewing the generated project description. That is a reason to budget for revalidation and human confirmation, not a reason to dismiss the product. A scanner looking for subtle application logic flaws will produce judgment calls.
Some open issues affect reliability. One report says malformed agent output is parsed outside the retry loop, so a batch can fail and remain for a later invocation instead of receiving an immediate second attempt. Another documents policy-refusal text being mistaken for malformed findings output. Pull requests address refusal classification, but users should monitor failed batches and status output rather than treating a completed command as complete coverage.
Exports include readable Markdown and machine-oriented data, while reporting, metrics, enrichment, and optional ownership plugins support follow-up. SARIF work is visible in open pull requests, but without a tagged release, teams should pin an exact package version and test export behavior before wiring it into a security gate.
Young, active, and worth a controlled trial
The last push was August 13, 2026, and issues and pull requests were updated the same day. GitHub showed 61 open items, consisting of 20 issues and 41 pull requests, so that number should not be read as 61 confirmed defects. The pace is strong for a repository created in April 2026, but there is no latest GitHub release to provide a stable adoption point.
Documentation is excellent for such a new project. Separate guides cover setup, supported technology, model choice, costs, configuration, plugins, architecture, state, CI, and the security model. The warnings are specific enough to make an informed decision, which matters more here than a frictionless demo.
Deepsec deserves a trial when a mature codebase may hide expensive authorization or data-flow mistakes that ordinary SAST keeps missing. Run it as a bounded audit on isolated infrastructure, compare its confirmed findings with Semgrep or CodeQL, and record the actual cost. Teams that need cheap, deterministic CI or strict local containment should wait for a stable release and an enforceable read-only profile.