shouldiuse.io

Categories

VERDICT

DeepSource Review

Depends

Should I use DeepSource?

Your team is writing more code with AI. DeepSource automates code reviews so you ship to production faster. - deepsource.com

· 1 month ago

Buy if you're a GitHub-based team shipping lots of AI-written code and want SAST, SCA, and AI review in one tool. Skip if you're a solo dev, already standardized on SonarQube or Semgrep, or need a vendor with a spotless incident record.

Confidence

Medium. Based on ~30 public sources; several review snippets were truncated and third-party pricing reports conflict, so verify quotes directly with the vendor.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence in sources
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Starterfrom ~$12/mo
Per-user (reported)~$30/user/mo

Best for

  • Teams shipping AI-generated code
  • GitHub-based startups wanting SAST+SCA+review in one
  • Python-heavy codebases
  • Teams replacing 3+ point tools

Not for

  • Solo devs — free analyzers and GitHub checks already cover you
  • Teams already standardized on SonarQube or Semgrep
  • Buyers requiring a vendor with zero incident history
  • Non-GitHub-heavy orgs — integration story centers on GitHub

Gotchas - check before you buy

medium

Committer-based billing counts everyone who commits — cost scales with whole team, not seats.

medium

Third-party pricing reports conflict ($12/mo vs $30/user/mo) — get a written quote first.

medium

Reported phishing incident forced full credential resets; ask about current controls.

low

Guess: deep GitHub integration creates lock-in if you switch VCS or leave.

Pros and cons

Pros

  • Ease of use consistently praised by reviewers
  • Bundles SAST, SCA, IaC review, and AI code review
  • Benchmarked on 165 real-world CVEs (OpenSSF)
  • Free and Starter plans available
  • Named customers include NASA and Ancestry

Cons

  • Mid-pack: ranked #6 of 11 AI code review tools
  • Committer-based billing can cost more than seat pricing
  • Two reported vendor security incidents
  • Pricing reports conflict: $12/mo vs $30/user/mo

Sources & method

- 10 sources - No vulnerabilities in the product found; vendor itself had two reported incidents: phishing credential theft and a GitHub app compromise.

official x4review x3security x2news x1
  • Phishing credential theft (Sawfish), An employee's credentials were stolen via Sawfish phishing; DeepSource reset all logins in response.
  • GitHub application compromise, DeepSource reported hackers compromised its GitHub application; its investigation reportedly did not identify further impact.

Key stats

  • Value for money: 3/5

    Rating

  • $0

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 3/5. Undercuts Code Climate; committer billing can inflate totals
  • Ease of use: 4/5. G2 reviewers consistently praise ease of use
  • Feature depth: 4/5. SAST, SCA, IaC review, AI review, CVE monitoring
  • Support quality. No support evidence in sources
  • Security posture: 2/5. Two incidents: phishing theft, GitHub app compromise
  • #6 of 11 Category rank AI code review tools tracked by Devtune
  • $12/mo Starting price Other reports cite ~$30/user/mo; committer-based billing
  • Yes Free tier Free + Starter plans on GitHub Marketplace
  • $7.8M Total raised Per LeadIQ; YC W20 alum

Pricing

Free

$0

  • Free plan listed on GitHub Marketplace
  • Entry point for small repos

Starter

from ~$12/mo

  • Entry paid tier per SpotSaaS
  • Confirm current price with vendor

Per-user (reported)

~$30/user/mo

  • Committer-based billing
  • Cited in Code Climate comparison

Security

No vulnerabilities in the product found; vendor itself had two reported incidents: phishing credential theft and a GitHub app compromise.

  • Phishing credential theft (Sawfish)An employee's credentials were stolen via Sawfish phishing; DeepSource reset all logins in response.⁵
  • GitHub application compromiseDeepSource reported hackers compromised its GitHub application; its investigation reportedly did not identify further impact.⁶

What users say

Users consistently praise ease of use, while some Reddit threads recommend incumbents like SonarQube instead.

“Users consistently praise the ease of…”
G2 review summary
“Suggest with the team to start using Sonarqube or…”
Reddit, r/dotnet

Alternatives

Compare DeepSource with each alternative.

  • SonarQube

    Battle-tested static analysis; Redditors frequently recommend it instead.

  • Semgrep

    Open-source, customizable SAST; the benchmark alternative in this category.

    DeepSource vs Semgrep

  • Code Climate

    Similar quality platform; DeepSource reportedly undercuts its pricing.

Companies that use it

  • NASA10
  • Ancestry
  • Omnigo
  • Grid AI
  • DVC
Full analysis

Based on ~30 public sources; several review snippets were truncated and third-party pricing reports conflict, so verify quotes directly with the vendor.

Solid all-in-one code quality & security for GitHub teams; committer billing and two vendor incidents say pilot first.

Methodology

Based on ~30 public sources; several review snippets were truncated and third-party pricing reports conflict, so verify quotes directly with the vendor.

Read how a report is made.

Sources

  1. G2 — DeepSource Reviewsg2.com
    review
  2. Dev.to — DeepSource vs Code Climatedev.to
    review
  3. Devtune — DeepSource category visibilitydevtune.ai
    review
  4. Hacker News — DeepSource launch (YC W20)news.ycombinator.com
    news
  5. BleepingComputer — Phishing incidentbleepingcomputer.com
    security
  6. SecurityWeek — GitHub app compromisesecurityweek.com
    security
  7. DeepSource — CVE Benchmarksdeepsource.com
    official
  8. DeepSource — Billing docsdocs.deepsource.com
    official
  9. GitHub Marketplace — DeepSourcegithub.com
    official
  10. DeepSource — NASA case studydeepsource.com
    official

Add this review to your site

This check for DeepSource says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends DeepSource Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.