DeepSource

DeepSource is a comprehensive, developer-focused DevSecOps platform designed to help teams ship high-quality and secure code efficiently. It integrates seamlessly into the development workflow, providing static analysis, security testing, and dependency management in a single, unified solution. Trusted by over 6,000 companies, from startups to Fortune 500s, DeepSource stands out as a modern alternative to legacy tools like SonarQube, offering a superior developer experience and more accurate results with a false-positive rate of less than 5%.

The platform operates directly within your version control system (like GitHub, GitLab, Bitbucket, and Azure DevOps), analyzing every commit and pull request. This proactive approach allows developers to find and fix thousands of security vulnerabilities and code quality issues before they are merged into the main branch, significantly improving code health and security posture from the ground up.

How to use DeepSource

Getting started with DeepSource is designed to be quick and straightforward, typically taking only about 5 minutes. The process involves these steps:

1. Sign Up & Connect: Create an account on the DeepSource website and connect it to your version control provider (GitHub, GitLab, Bitbucket, or Azure DevOps).
2. Activate Repositories: Choose the repositories you want DeepSource to analyze. The platform will automatically detect the languages and frameworks used in your project.
3. Configuration (Optional): DeepSource works out-of-the-box with zero CI configuration. However, you can create a `.deepsource.toml` file in your repository's root for advanced customization, such as enabling specific analyzers, ignoring certain issues, or setting metric thresholds.
4. Analyze Pull Requests: Once activated, DeepSource automatically analyzes every new pull request. It posts comments directly in the pull request with an overview of new issues, allowing developers to see and fix problems without leaving their workflow.
5. Use the Dashboard: For a deeper dive, developers can visit the DeepSource dashboard to see a comprehensive report of all existing issues, track code quality and security metrics over time, and manage project settings.
6. Leverage Autofix™: For many common issues, DeepSource's AI-powered Autofix™ feature can generate suggested fixes, which you can apply with a single click, creating a new commit automatically.

Core Features of DeepSource

• SAST (Static Application Security Testing): Identifies security vulnerabilities in your source code, covering standards like OWASP® Top 10 and CWE/SANS Top 25.
• SCA (Software Composition Analysis): Scans your third-party dependencies for known vulnerabilities and license compliance issues.
• Code Quality Analysis: Detects thousands of code smells, bug risks, anti-patterns, and performance issues across a wide range of programming languages.
• IaC (Infrastructure as Code) Security: Scans configuration files (like Terraform) for security misconfigurations.
• Autofix™ AI: An AI-powered feature that automatically suggests fixes for many detected issues, dramatically speeding up remediation.
• Code Coverage: Tracks and reports on the test coverage of your code, ensuring new changes are adequately tested.
• Seamless VCS Integration: Native integration with GitHub, GitLab, Bitbucket, and Azure DevOps, providing analysis directly in pull requests without requiring complex CI setup.
• Quality & Security Gates: Allows teams to define and enforce specific standards, blocking pull requests that don't meet the required criteria for quality or security.
• Detailed Reporting: Generates shareable reports, including OWASP® Top 10 reports, to provide insights to team members and stakeholders.

Use Cases for DeepSource

DeepSource is versatile and valuable for various scenarios in software development:

• Automated Code Review: Augments manual code reviews by automatically catching a wide range of issues, freeing up developers to focus on logic and architecture.
• Continuous Security: Implements a 'shift-left' security approach by integrating security scanning (SAST & SCA) directly into the development process, catching vulnerabilities early.
• Maintaining Code Health: Helps teams manage and reduce technical debt by continuously monitoring code quality and providing actionable insights.
• Onboarding New Developers: Acts as a guide for new team members, helping them adhere to the team's coding standards and best practices from their first commit.
• Compliance and Auditing: Generates reports (e.g., OWASP Top 10) that can be used for security audits and to demonstrate compliance with industry standards.

Advantages of DeepSource

DeepSource offers several key advantages over traditional code analysis tools:

• Developer-First Experience: The tool is built for developers, with a modern UI and a workflow that integrates smoothly without being disruptive.
• High Accuracy: Boasts a very low false-positive rate (under 5%), ensuring that developers can trust the issues it raises.
• Unified Platform: Combines SAST, SCA, and code quality analysis into one tool, eliminating the need to manage and pay for multiple disparate solutions.
• AI-Powered Efficiency: Features like Autofix™ and smart issue detection accelerate the development process.
• Transparent Pricing: Offers a clear, per-seat pricing model, which is more predictable and often more cost-effective than the lines-of-code-based pricing of competitors like SonarQube.
• No CI Overhead: Core analysis runs without requiring dedicated CI build time, making it faster and easier to implement.

Pricing and Plans

DeepSource offers a transparent, per-seat pricing structure with several tiers:

• Free Plan: $0/seat/month. Ideal for individuals and small teams. Includes unlimited public repositories, 1 private repository, up to 3 team members, and limited analysis/Autofix™ runs.
• Starter Plan: $8/seat/month. Designed for growing teams. Includes unlimited public and private repositories, unlimited analysis runs, and limited usage of Autofix™ and Transformers.
• Business Plan: $24/seat/month. For established teams and businesses. Includes all Starter features plus unlimited Autofix™ and Transformer usage, monorepo support, audit logs, and priority support.
• Enterprise Plan: Custom pricing. For large organizations with advanced needs. Includes all Business features plus options for self-hosted deployment (including air-gapped), Single Sign-On (SSO), dedicated support with SLAs, and more.

A 20% discount is available for annual billing.