Vercel Simplifies deepsec Onboarding With a Single Setup Command.

Vercel has reduced the setup process for deepsec, its open-source security review harness, to a single command. Running npx deepsec init from a repository root now prepares the workspace, configures model access, analyzes the codebase, scans for suspicious patterns, and begins an AI review.

The change targets a familiar problem with security tooling: getting from installation to a useful first result often requires several configuration steps. According to Vercel’s official changelog, deepsec’s new initialization command automates that sequence while preserving the ability to resume an interrupted run.

The command creates an isolated .deepsec/ workspace inside the repository and installs the dependencies needed to conduct a review. Vercel says this directory is the only item deepsec adds to the repository, which should make its footprint easier for developers to identify and manage.

From there, the initializer completes five parts of the setup:

• Creates the workspace: It adds the .deepsec/ directory and installs deepsec’s dependencies.
• Configures model access: Teams can connect through Vercel AI Gateway or supply keys for their own model provider.
• Maps the application: deepsec generates a description of the codebase and its attack surface. That description becomes a foundation for subsequent reviews.
• Runs a pattern scan: The tool applies its built-in scanning patterns and generates additional patterns when it identifies gaps in coverage.
• Starts the AI review: Files flagged during scanning are passed into the AI-based review process.

That progression matters because deepsec is not simply sending an entire repository to a model and requesting a broad security assessment. The workflow first builds context about the application, then uses pattern scanning to narrow the areas that require closer inspection.

The initialization process is also checkpointed after every step. If a review stops because the process is closed, a step fails, or the run reaches a cost or duration limit, running npx deepsec init again resumes it from the latest completed checkpoint. Developers should not have to restart the full setup and scanning sequence.

For small development teams, the practical benefit is less operational work before the first scan. A founder or builder can initialize deepsec from the same terminal used for application development, rather than separately creating a workspace, configuring model access, documenting the attack surface, and launching each scanning stage.

The release also continues Vercel’s broader push toward command-line setup. The company recently expanded Vercel Connect CLI setup to more than 100 connectors, another effort to move configuration into repeatable terminal workflows.

Still, this update is primarily an onboarding improvement. Vercel has not announced a new security model, expanded detection benchmark, or guarantee that an AI review will find every vulnerability. Teams should treat deepsec as part of a wider review process that can include dependency scanning, manual code review, testing, and remediation checks.

Vercel has not specified pricing or plan requirements in the announcement. deepsec itself is open source, while model usage may depend on whether a team connects through Vercel AI Gateway or supplies credentials for another provider. Full setup instructions are available in the deepsec getting-started documentation.

What is Vercel deepsec?

deepsec is Vercel’s open-source security review harness for code repositories. It maps a codebase and its attack surface, runs pattern-based scans, and uses AI to review files flagged by that process.

How does the new deepsec setup work?

A developer runs npx deepsec init from the repository root. The command creates the .deepsec/ workspace, configures model access, analyzes the codebase, runs pattern scans, and starts the first AI review.

What happens if a deepsec initialization run stops?

The setup is checkpointed after each stage. Running the initialization command again resumes from the last completed checkpoint, including when a process was closed, a step failed, or a cost or duration limit was reached.