Vercel Labs ships deepsec and openly admits scans can cost tens of thousands of dollars.

vercel-labs/deepsec (6,383 stars, +1,082 this week) runs a three-stage pipeline: scan with regex matchers and no AI, process for AI investigation emitting findings plus a recommendation, and revalidate re-checking existing findings against git history to see if they were already fixed, with a tunable --thinking-level (GitHub). The README's candor is the story. It states plainly that scans can cost thousands to tens of thousands of dollars on large repos, which is a rare public admission of what deep agentic analysis actually costs. The revalidate-against-git-history step is the reusable idea for anyone whose scanner keeps re-reporting fixed issues.