deepsec-integrationlisted

# DeepSec — agent-powered deep security audit [deepsec](https://github.com/vercel-labs/deepsec) by Vercel Labs (Apache-2.0, ~700 stars). Wraps coding agents at maximum thinking levels to find: - subtle auth-bypass paths - TOCTOU race conditions - crypto misuse (custom IV, key reuse) - SSRF in user-controllable URL handlers - prototype pollution, ReDoS in dynamic regex - vulnerable dep transitive paths static SAST misses Distinct from `daily-supply-chain-audit` (which is dep-tree CVE scanning). DeepSec reads YOUR code semantically. ## When to invoke | Trigger | Example | |---|---| | Pre-launch deep audit | "Run deepsec on [project-a] before going to mainnet" | | Post-incident root cause | "Scan [company]-rpc for the auth-bypass class we just patched" | | Periodic deep dive | "Quarterly deepsec on [project-b]" | | Specific concern | "Deepsec the new Solana program in anchor-vault" | DO NOT run automatically. DO NOT run on every PR (cost). DO confirm budget before kicking off. ## Cost reality Per the project's own README: scans can cost **thousands of dollars** for large repos because they fan out parallel workers at maximum reasoning depth. **Walter-OS budget guardrail**: - Confirm $ before any scan - Use scoped repos (small components, not monorepos) - Default model tier: Opus or GPT-5.5-pro (cheaper than maximum) - Cap fan-out workers at 2 unless operator overrides ## Setup (per repo, one-time) ```bash cd ~/Projects-Personal/<repo> # or ~/work/<repo> npx deepsec