Supercov vs DeepSeek security agents

The difference

RealVuln ran three DeepSeek models as agents that read a repository and report vulnerabilities. They are the cheapest AI scanners in the test, and the V4 Flash agent is cheaper than Supercov. Supercov is faster: seconds rather than minutes.

Results

72 deliberately vulnerable repositories, 2,016 labelled vulnerabilities.

	Supercov 2.0.1	DeepSeek V4 Flash	DeepSeek V4.1 Flash	DeepSeek V4 Pro
F1	0.42	0.48	0.51	0.46
Finds	43%	41%	50%	37%
Right	42%	59%	53%	63%
Median time	10 s	2.6 min	1.6 min	3.8 min
Cost per repository	5¢	2¢	not recorded	7¢

Supercov finds more than V4 Flash and V4 Pro, but they are right more often, so their F1 is higher.

By language

F1	Supercov	V4 Flash	V4.1 Flash	V4 Pro
Python, 32 repositories	0.54	0.62	0.64	0.61
TypeScript, 27	0.36	0.40	0.42	0.34
JavaScript, 13	0.34	0.35	0.43	0.39

On TypeScript, Supercov is ahead of V4 Pro.

Choose a DeepSeek agent when

cost matters most and a few minutes per repository is fine;
you are comfortable running an agent harness around the model yourself.

Choose Supercov when

your agent should check every change without waiting minutes;
you want one command with no harness to build or maintain;
you want the same checks every run, so a new finding means the code changed.

See Accuracy, speed and cost for how this was measured.