Vercel releases deepsec, an AI scanner that hunts for hidden vulnerabilities in code

Vercel has released deepsec, an open-source tool and AI harness for finding vulnerabilities in large codebases. It is the first security scanner that runs on your infrastructure, with your API keys, without sending source code to the cloud. The idea is simple: instead of shipping sensitive code to someone else's servers, Claude and GPT agents analyze it locally.

Why deepsec is needed

Existing security scanners (such as SAST tools) often produce so many false positives that their results become unusable. The other option is to hire a security audit firm, but that is expensive and slow. deepsec tries to fill the gap: AI agents that work like an experienced security engineer, but cheaply, quickly and locally.

Architecture and capabilities

Deepsec uses Claude Opus 4.7 in max effort mode and GPT-5.5 with high-level reasoning. The tool can run locally on your laptop, with no need to set up cloud services. To scale to large monorepos, deepsec supports parallel execution through Vercel Sandboxes: during development, Vercel ran scans on 1000+ concurrent instances. Scanning a large repository on a single machine can take several days, which is why parallelism is critical.

How scanning works

The process has five stages:

• Scan — regular expressions find security-sensitive files and functions
• Investigate — coding agents analyze each candidate in depth, trace data flows and check mitigations
• Revalidate — a second pass by agents filters out false positives and reclassifies the severity of each finding
• Enrich — an agent uses git metadata to identify the developers who should fix the issue
• Export — results are converted into actionable instructions for creating tickets in a tracking system

Results on real projects

Vercel tested deepsec on its own monorepos and on open projects of its customers. The results impressed even experienced security engineers and founders. In the open code of dub.co (a link-shortening platform with complex attribution systems for affiliate programs), deepsec found hidden bugs in authentication logic: subtle edge cases in authentication conditions. The bugs were truly cryptic: standard SAST tools did not detect them, but they could lead to unauthorized access. The results prompted Vercel to develop a custom scanner plugin to check all authentication paths in its own monorepos.

"We get a lot of automated security reports, but most of them are

unusable. deepsec is the first tool that found exactly the issues a security engineer would have flagged, and it runs on our infrastructure." — Steven Tey, founder of dub.co

What this means

Automated security scanning is moving out of the realm of cloud services and into privacy-first tools. For developers and security teams, this means you can look for vulnerabilities without sending code to the cloud, with full privacy, using the Claude and OpenAI API keys you already have. Tools like deepsec are starting to fill the niche between expensive professional security audits (which take weeks and cost hundreds of thousands) and ineffective automated scanners (which produce 95% false positives). This could potentially become a standard in the security pipeline of large companies.