# Introducing deepsec: The security harness for finding vulnerabilities in your codebase

DevFeed: [Introducing deepsec: The security harness for finding vulnerabilities in your codebase](<https://devfeed.tech/articles/introducing-deepsec-the-security-harness-for-finding-vulnerabilities-in-your-codebase-760.md>)

Original publisher: [Read original article](<https://vercel.com/blog/introducing-deepsec-find-and-fix-vulnerabilities-in-your-code-base>)

Author: Malte Ubl

Published: 2026-05-04T04:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [AI Bots](<https://devfeed.tech/topics/ai-bots.md>), [AI Chat](<https://devfeed.tech/topics/ai-chat.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [analysis](<https://devfeed.tech/tags/analysis.md>), [claude](<https://devfeed.tech/tags/claude.md>), [codex](<https://devfeed.tech/tags/codex.md>), [git](<https://devfeed.tech/tags/git.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [sandboxes](<https://devfeed.tech/tags/sandboxes.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

Deepsec is an open-source security harness that uses coding agents to find and validate vulnerabilities in large codebases.

## Source excerpt

Today we're open sourcing deepsec: a security harness powered by coding agents. It runs on your own infrastructure and surfaces hard-to-find issues in large codebases. You can run deepsec on your laptop without setting up a cloud service for privileged source code access. For inference, you can use your existing Claude or Codex subscription without any additional setup. Scanning large repos can take multiple days on a single machine. To run research jobs in parallel, deepsec supports optional fanout to Vercel Sandboxes for remote execution. Scans on Vercel's codebases routinely scale up to 1,000+ concurrent sandboxes. Architecture At its core, deepsec uses claude and codex to perform tailored investigation of a codebase using Opus 4.7 at max effort and GPT 5.5 at xhigh reasoning. Scans start with static analysis to identify security-sensitive files, then coding agents investigate each candidate, tracing data flows, checking for mitigations, and producing actionable findings with severity ratings. Here is the workflow: Scan: It starts by performing a regex-only scan of all files for security-sensitive areas that subsequent steps will focus on. Investigate: Agents investigate each file identified in the scan. Revalidate: A second agent run validates investigation findings to remove false positives and reclassify severity. Enrich: Once investigation is complete, an agent uses git metadata and other optional services to identify the contributors responsible for fixing each issue. Export: The export command formats the findings as instructions so that they can be turned into tickets for humans and coding agents. Running deepsec on production code deepsec has been highly useful on our own monorepos and for our customers' codebases. During development, we ran deepsec on several open source repositories of Vercel customers and partners. For example, deepsec scanned the open source version of dub.co. Dub is a marketing attribution platform for affiliate programs and short li