New: Hybrid AI Agent for Secrets Detection 🔒 ✨

We've released a new detection engine for our Secrets Analyzer that finds more valid secrets in your source code while greatly reducing false-positives. This makes DeepSource the best way to run secrets analysis on your code.

🚨 We’ve officially made it to Times Square! 🚨

DeepSource Agents are now front and center in the world’s most iconic digital billboard space! What better way to celebrate than with a little extra visibility?

Ship code fearlessly.

👀 Did you spot the DeepSource truck around the RSA Conference last week?

Last Friday in San Francisco: We gathered an eclectic group of security leaders, CTOs, and founders to give them a peek at DeepSource Agents, our autonomous AI agents for code security.

🗓️ 4/25 in San Francisco: We're hosting an intimate gathering of founders, security leaders, and CTOs for a thought-provoking conversation around AI agents in security — and unveiling something radically new from DeepSource.

Register: lu.ma/bdycpip5 (limited spots)

Finally, DeepSource SCA is the only one on the market that's transparently priced — per target.

Each combination of a manifest file (like package.json) and a lock file (like package-lock.json) counts as a target. All features are included in this price, bar none.

3️⃣ Dynamic Risk.

We've invented a new scoring system that enables you to assign custom weights and strategies to CVSS scores, EPSS scores, and percentiles, using reachability information to assign a Dynamic Risk to each vulnerability—so your security can finally be personalized.

2️⃣ World's first multi-variate auto-remediation engine.

Upgrading dependencies to fix vulnerabilities is tricky. Traditional SCA tools don't help you automatically create fixes. Those that do use a naïve approach—"Here, upgrade to the latest version of the package."

1️⃣ Industry-leading Reachability Analysis.

Our static analyzer starts with function calls right at the top of your code and traverses this graph down to the third-party code by tracking every single function call in the file and across all referenced files using import tracking.

✨ Introducing, DeepSource SCA: Intelligent Supply Chain Security that helps you secure your open-source dependencies with best-in-class static analysis and Autofix™ AI.

Learn more: deepsource.com/platform/sca

DeepSource SCA is built for modern AppSec, with three key innovations:

We were delighted to see our Globstar launch covered by Mike Vizard in @devopsdotcom.

Read the full coverage: devops.com/deepsource-...

2. Several improvements to Globstar: an all-new Go API to write custom checkers, which gives you the full power of tree-sitter bindings and advanced capabilities like multi-file analysis and scope resolution.

🔽 🔽 🔽

Happy Friday, y'all!

Our latest changelog is out and we've shipped three key things:

1. An all-new DeepSource Directory, where you can explore all static analysis and SAST checkers across 20+ Analyzers on DeepSource.

🔽 🔽 🔽

We get it: if you've been stuck with a legacy SAST system, DeepSource might feel... different.

We don't ask you to make changes to your already complex CI pipeline.

We don't show you all the issues in your repository all at once without any prioritization.

Just a fresh take on code health. 🤷🏼

Happy Wednesday! ✨

We just published the latest changelog, with some of the updates to the DeepSource platform from the last couple of weeks:

1️⃣ Improvements to the Secrets Analyzer

2️⃣ A refreshed application navigation

3️⃣ New mutations in the GraphQL API

Writing a Globstar checker is easy — all you need is a simple YAML syntax and native tree-sitter S-expressions.

Here's an example ⏬