Vercel has open sourced deepsec, a security review tool that uses coding agents to inspect large application codebases for hard-to-find vulnerabilities. The project is positioned less as a traditional rules engine and more as a repeatable research pipeline that teams can run on infrastructure they control.

What Vercel shipped

According to Vercel's launch post and the project's GitHub repository, deepsec starts with a regex-based scan to flag security-sensitive files, then hands those candidates to agent backends for investigation. The current pipeline is split into scan, process, revalidate, enrich, and export stages, with each stage writing structured results back to disk so runs can be resumed or repeated.

Vercel says the tool can run locally with existing Claude or Codex subscriptions, while larger jobs can fan out across Vercel Sandbox workers in parallel. The company also says its internal scans have scaled to more than 1,000 concurrent sandboxes, though that figure is company-reported rather than independently verified.

Why it matters

The more notable signal is architectural. Instead of shipping another hosted scanner, Vercel is open sourcing a workflow for agent-led code review that can stay close to private repositories and existing developer tooling. For security teams experimenting with AI-assisted auditing, that makes deepsec a concrete reference point for how agents, static matching, and human follow-up can be combined without turning the entire process into a black-box service.