DeepAudit

DeepAudit is an AI code security auditing platform for developers and security researchers who want to investigate vulnerabilities in their projects. It combines automated code review with executable tests to help assess whether suspected flaws are exploitable.

• Agent-led audits: Coordinated AI agents examine project structure, trace risks across files, and use CWE/CVE knowledge to investigate issues such as injection, authentication bypass, and exposed secrets.
• Sandbox verification: The tool generates proof-of-concept scripts and runs them in isolated Docker containers to test suspected vulnerabilities, retry failed checks, and filter findings identified as false positives.
• Project and snippet review: Import projects from GitHub, GitLab, or Gitea, upload ZIP archives, or submit individual files and pasted code for analysis.
• Rules and findings: Reviews cover security, bugs, performance, style, and maintainability, with issue locations, explanations, and suggested fixes; audits support OWASP Top 10 and custom rules.
• Audit reports: Follow agent activity in live logs and export reports as PDF, Markdown, or JSON.

DeepAudit is open source under AGPL-3.0 and runs as a self-hosted application with Docker deployment support. Ollama can keep code analysis within your own network using models such as Llama3, Qwen2.5, CodeLlama, and DeepSeek-Coder. You can also use external providers including OpenAI, Claude, and Google Gemini, but those choices send code to the selected provider's servers.

The project limits use to education and research in authorized environments and prohibits unauthorized security testing.