DeepSec / Documentation / v1.1.0

Inspect the system. Keep the evidence.

DeepSec runs source, dependency, secret, infrastructure, container, license, and website checks from one Go binary. Results remain local unless the target itself requires network access.

Install DeepSec Browse verified builds

1 binaryCross-platform CLI

7 outputsLocal report formats

Apache 2.0Open source release

Installation

Resolve one verified binary.

The installer selects a platform artifact, downloads its adjacent SHA-256 file, validates the digest, and writes the executable to the selected bin directory.

Default location: ~/.local/bin/deepsec. Use INSTALL_DIR=/usr/local/bin for a system-wide install.

Download install.sh Manual downloads

terminalinstall

curl -fsSL https://cdn.pixelcity.top/deepsec/install.sh | sh

# Inspect installer options
curl -fsSL https://cdn.pixelcity.top/deepsec/install.sh | sh -s -- --help

# Verify the installed CLI
deepsec --version

Local analysis

Start with the current directory.

A local scan discovers supported source, dependency, infrastructure, container, and secret files. The command does not upload the working tree.

SRC

Source patterns

Security-focused static analysis across common language and configuration formats.

View commands

DEP

Dependency manifests

Known-vulnerability checks for package locks and supported package ecosystems.

View commands

KEY

Secret material

Credential-pattern checks with file, line, rule, and remediation context.

View commands

IAC

Infrastructure

Dockerfiles, Compose definitions, and infrastructure-as-code security checks.

View commands

LIC

License metadata

Dependency license inventory and compatibility signals for policy review.

View commands

ALL

Scanner selection

Run the default suite or select individual scanners for a narrower execution profile.

Configure scans

Command reference

Useful commands.

Commands use explicit output when integration matters. Interactive terminal output remains the default for quick local review.

scanlocal

# Scan the current working tree
deepsec scan .

# Raise the reporting threshold
deepsec scan . --severity medium

# Write a shareable HTML report
deepsec scan . --format html --output report.html

# Produce machine-readable output
deepsec scan . --format json --output findings.json

webscanremote target

# Inspect a public website
deepsec webscan https://example.com

# Keep medium findings and above
deepsec webscan https://example.com --severity medium

# Save SARIF for code-scanning ingestion
deepsec webscan https://example.com \
  --format sarif --output webscan.sarif

Evidence formats

Use the output that fits the review.

Every finding can carry severity, rule identity, source location, remediation context, and a risk contribution suitable for aggregation.

Format	Primary use	Example
Table	Interactive local review	`deepsec scan . --format table`
HTML	Shareable engineering or audit report	`--format html --output report.html`
JSON	Automation and custom pipelines	`--format json --output findings.json`
SARIF	Static-analysis interchange	`--format sarif --output results.sarif`
CycloneDX	Dependency SBOM	`--format cyclonedx --output sbom.json`
SPDX	Dependency SBOM	`--format spdx --output sbom.spdx`

WebScan

Inspect the public HTTP surface.

WebScan evaluates transport, headers, cookies, CORS, exposed resources, common injection indicators, redirects, and metadata disclosure. Use only against systems you are authorized to test.

TLS and transport

Certificate validity, HTTPS behavior, redirect chains, and protocol-level configuration.

Browser defenses

CSP, HSTS, frame restrictions, MIME protection, referrer policy, and related headers.

Origin controls

CORS behavior, cookie attributes, mixed-content signals, and cross-origin policy.

Exposed resources

Public metadata, directory indexing, source-control paths, and sensitive-file indicators.

Injection indicators

Safe request probes for reflected XSS, SQL error behavior, and open redirects.

Disclosure

Server banners, host headers, security contact metadata, and response fingerprinting.

Configuration

Make repeat scans explicit.

Most projects can use defaults. A configuration file is useful when scanner scope, severity, or exclusions must remain stable across local and CI runs.

Principle: exclusions should document why a rule is intentionally suppressed. Avoid broad patterns that hide unrelated findings.

Review source

.deepsec.yamlconfiguration

version: "1.1.0"

scanners:
  sast: true
  sca: true
  secrets: true
  iac: true
  container: true
  license: true
  webscan: true

filter:
  min_severity: low
  exclude_rules: []

Source and support

Inspect the implementation.

Use the public repository for build instructions, issue tracking, release context, and changes to scanner rules or report formats.

GitHub

Source, issues, releases, and contribution context.

Open repository

Security contact

Report a vulnerability through the published security contact.

Email security