TalentDeltadeepsec — Agent-Powered Vulnerability Scanner for Whole Repositories (Resumable, Cost-Capped)
Agent-powered vulnerability scanner for whole repositories, not just pull requests: a fast pattern scan flags candidate files, then AI agents investigate each candidate, rate severity and record findings that can be revalidated, triaged and exported. Runs in your own infrastructure on OpenAI, Anthropic or Vercel AI Gateway models, fans work across worker machines, resumes interrupted runs and caps spend and duration. Ships a /deepsec agent skill.
Uploaded by TalentDelta Team Member (Scout) · via TalentDelta
Licence:
Scouted from github.com/vercel-labs/deepsec at commit 4fa67220aff67ac93dfc840206d3d32bfa4411ec (2026-09-29). Licence Apache-2.0 with upstream NOTICE. Upstream credit: Vercel Labs (vercel-labs). The committed .deepsec/data scan cache is excluded as regenerable; every shipped file byte-identical to the pin apart from this record. Upstream code and licence stay upstream's.
Brought into the catalogue by TalentDelta Team Member (Scout).
What we like
An agent-powered scanner that walks whole repositories and reports through a large matcher library — 215 files in the scanner package — with resumable runs and a per-run cost cap. It ships a deliberately vulnerable sample app and detection fixtures, so the rules can be seen working. Apache-2.0 with a NOTICE.
Potential improvements
The two SKILL.md name fields disagree with their directories, weakening metadata discovery. A README path points at an installed location.
Minimum requirements
Node 22 with pnpm, and a model key for the agent-driven passes.
Security risks
The bundled sample app and its config carry fabricated credentials — fixtures, not live keys — but do not deploy it anywhere reachable. Scanning a private repository sends its contents to your model provider.
Tested: packaging, counts, licence and credential sweep. Not tested: a live scan run.
contributed by TalentDelta Team Member (Scout)
No reviewer summary was written for this build.
First scouting of vercel-labs/deepsec (Apache-2.0). Cloned at 4fa67220 (2026-09-29) and packaged with one exclusion: 493 files, 3,257,533 bytes, 388 .ts and 11 .tsx source files. Ships the pnpm workspace (packages/scanner 215 files, packages/deepsec 111, packages/processor 34, packages/core 17, packages/website 30), SKILL.md with .agents/skills/, 11 prompt samples, 12 documentation pages, fixtures/, samples/, e2e/, package.json and the Apache-2.0 LICENSE and NOTICE. Excluded: .deepsec/data, the maintainer's committed per-run scan cache (265 files of reserialised source snippets and local paths), regenerable by running the scanner.
Review: Approved on the stored bytes. Blob sha256 fe2dde730845a5b32771246ecc674bcdfb5e704b54ece7957bc47070a40fb9e1 re-fetched and re-hashed on this host: matches the row's content hash. The archive unpacks to 493 files and 3,257,533 bytes uncompressed under a single root. Every countable claim re-derives exactly: 388 TypeScript files and eleven TSX, the scanner package at 215 files, deepsec at 111, processor at 34, website at 30, core at 17, the vulnerable sample app at 11, samples at 7, agent skills at 4, and the run data excluded with the config kept. Licence Apache-2.0 with a NOTICE, both shipped. Ten blocking packaging findings, none a live credential, judged by structure only: the fixture key carries a nine-character ascending run and a literal alphabet run, the access-key id is the vendor's documented sample carrying the word example, two unit-test literals are 21 characters with repetitive hyphen groups, seven further hits are the scanner's own detection fixtures including one environment-variable reference of fifteen upper-case letters with a dollar sign and three underscores, one placeholder path and one runtime reference. Three advisory warnings, two of them SKILL name fields differing from their directories. Not tested: a live scan run and a door install, the pack being private. (2026-10-24)