deepsec

No entries match these filters. Clear filters

1. changes since 2026-08-09 Aug 13, 2026 · issue 044

   deepsec adds a local model route so machines with an existing claude/codex login skip all credential setup and env-var checks.

   └──▷ TRY IT
   Bootstrap a workspace on a machine already logged in to the claude CLI, skipping all cloud credential setup.
   copy

   $ pnpm deepsec --model-auth local

   Persist the local-subscription route in config so every subsequent preflight skips env-var checks automatically.
   deepsec.config.yaml copy

   ai:
     mode: local
     provider: local

   • Adds --model-auth local CLI flag (and interactive Use local subscriptions as option 4 in the model-access prompt) to configure a local model route, delegating model auth entirely to the machine-wide claude/codex login — no credential is resolved, injected, or verified.
   • Sandbox commands under the local route still require AI_GATEWAY_API_KEY (an ambient key is accepted), preserving the firewall token-brokering requirement.
   • Documents --scaffold-only in docs/getting-started.md, including what it writes, what it skips, and how to resume the automated flow later, plus a Using local subscriptions section across models.md, FAQ, CLI help, and the scaffolded workspace README.

   3 details in Everything

2. changes since 2026-07-11 Aug 9, 2026 · issue 041
   • Ships one-shot Deepsec initialization (coordinator.ts) to scaffold a project from scratch without manual setup steps.
   • Introduces stable, deterministic findingId values (SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. of projectId + normalized path + title) assigned at append time and lazily backfilled on old records, so finding identity survives across revalidation runs.
   • Adds permissive verdict reconciliation for revalidate: verdicts now match by alias/findingId → exact title → normalized title → unique 1:1 remainder, with a matchedBy diagnostic recorded per match, replacing the previous exact-equality-only approach that silently dropped mismatched verdicts.
   • Adds short per-invocation prompt aliases (F1…Fn) mapping to stable finding IDs so agents never see raw hashes in prompts.
   • Introduces attack-surface coverage analysis (coverage.ts) with typed SurfaceKind (http, rpc, queue, cron, cli, webhook, agent-tool, other) and SurfaceExposure (public, authenticated, internal, mixed, unknown) inventories, enabling structured surface-aware scanning.

   +1 more show less

   • Exports new processor primitives — reconcileVerdicts, buildAliasMap, expectedFindingsForBatch, resolveDuplicateRef, ensureFindingIds, attributionHeaders, setAttributionVersion, isGatewayBaseUrl — for use in custom integrations.
3. changes since 2026-07-09 Aug 7, 2026 · issue 039

   deepsec gains --thinking-level, one-shot initialization, stable finding IDs, and a broadened SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. matcher.

   • Adds --thinking-level CLI flag to control agent reasoning depth during scans.
   • Ships one-shot Deepsec initialization (PR #139) to bootstrap a workspace in a single command.
   • Introduces stable finding IDs and permissive verdict reconciliation in the revalidate workflow, backed by ensureFindingIds and reconcileVerdicts.
   • Broadens the SSRF matcher to cover a wider range of server-side request forgeryserver-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. patterns.

   4 details in Everything