Vercel open-sources deepsec security harness

The interesting part here is not “AI security scanning” in the abstract, it’s the workflow split: cheap static narrowing first, expensive agentic reasoning second. That is the right shape for finding subtle issues in real repos.

• –Strong fit for large application and service repos where security bugs are buried in business logic, auth paths, and data flow edges.
• –The on-your-own-infrastructure story matters for teams that cannot ship source code to a third-party SaaS scanner.
• –Optional sandbox fanout makes the system more credible for monorepos and long-running research jobs.
• –The tradeoff is expected false positives and matcher tuning, so this still needs security-engineer oversight rather than full autopilot.
• –Best viewed as an internal security research harness that productizes deep review workflows, not a replacement for classic SAST.