vercel-labs / deepsec

The skill itself does no scanning. It is the operating manual for the deepsec npm CLI — init, scan, process, triage, revalidate, enrich, report, export, metrics, status, and a sandbox variant of each that fans work across Vercel Sandbox microVMs. The CLI is what actually finds vulnerabilities: it runs the largest available models at maximum thinking effort against your code, resumes from wherever an interrupted run stopped, and writes findings back as JSON or Markdown per project.

That model spend is the real story here, not an aside. The README states plainly that scans "can cost thousands or even tens-of-thousands of dollars for large codebases," and that an existing Claude Pro/Max or ChatGPT Plus subscription is fine for trying deepsec but does not have enough headroom for a full repository scan — you are expected to bring a Vercel AI Gateway key sized for concurrent research-grade usage. This is a tool for a team with budget already earmarked for security scanning, not something to point at a side project on a whim.