DEVOURED
Inside Vercel's Security Tool Deepsec
Vercel open sourced deepsec, an AI agent-powered security scanner that uses Claude and GPT models to autonomously investigate codebases for complex vulnerabilities with a 10-20% false positive rate.
What: Deepsec is an open source security scanning tool that uses AI coding agents (Claude Opus 4.7 and GPT 5.5) to analyze codebases through a multi-step workflow: scanning for security-sensitive files with regex, having agents investigate each candidate by tracing data flows, revalidating findings to reduce false positives, enriching results with git metadata to identify responsible developers, and exporting actionable reports.
Why it matters: Traditional automated security scanners produce too many false positives and miss nuanced issues like subtle authentication edge cases. Deepsec aims to surface the kinds of vulnerabilities a human security engineer would catch while scaling to massive codebases through parallel execution across thousands of cloud sandboxes, making deep security analysis practical for large monorepos.
Takeaway: Run npx deepsec init at your repository root to start scanning, then use it with your coding agent to generate custom regex matchers based on initial findings that are tuned to your specific authentication model and codebase conventions.
Deep dive
- Deepsec runs entirely on your own infrastructure (locally or on Vercel Sandboxes) so privileged source code never leaves your control, using your existing Claude or GPT API subscriptions
- The five-stage workflow starts with regex-based static analysis to identify security-sensitive files, then dispatches AI agents to investigate each candidate individually
- Investigation agents trace data flows through the codebase and check for security mitigations, producing findings with severity ratings
- A separate revalidation step uses a second agent run to filter false positives and reclassify severity levels, bringing the false positive rate to 10-20%
- Scans of Vercel's own codebases routinely scale to 1,000+ concurrent sandboxes running in parallel; single-machine scans can take multiple days for large repositories
- Production testing on dub.co (an open source marketing attribution platform with auth, database, and backend services) surfaced actionable security issues that impressed the founder
- Vercel used deepsec findings on their own monorepos to develop custom scanner plugins covering every authentication path in their code
- The plugin system allows custom regex matchers tuned to your specific authentication model, data layer, or team conventions
- Deepsec includes a classifier that detects model refusals after each research step, though refusals are reportedly a non-issue with current models
- The tool works with standard Claude Opus 4.7 and GPT 5.5 models without requiring special "cyber" fine-tuned versions, though it supports those too
- Best suited for applications and services rather than libraries or frameworks, which would likely need custom prompts and scanners
- The enrichment step uses git metadata and optional services to identify which developers should fix each discovered issue
- Export formats findings as instructions that can become tickets for both human developers and coding agents to remediate
Decoder
- Opus 4.7: Anthropic's Claude model version referenced in the article (likely future/hypothetical given current date context)
- GPT 5.5: OpenAI model version referenced with "xhigh reasoning" capability (likely future/hypothetical)
- Static analysis: Code examination technique that analyzes source code without executing it, typically using pattern matching
- Sandboxes: Isolated execution environments that run code safely without affecting production systems
- False positive: A security alert for an issue that doesn't actually exist or isn't exploitable
- Data flow tracing: Following how data moves through a codebase to identify where user input might reach sensitive operations without proper validation
- Monorepo: A single repository containing multiple projects or services, common at large companies like Vercel
- Cyber model: Fine-tuned AI models specifically trained to perform security research tasks that base models might refuse
Original article
Deepsec is an agent-driven security tool that scans large codebases locally or in parallel cloud sandboxes to uncover complex vulnerabilities.
Explore all 52 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi