Pricing
Scan for free, with no account. Upgrade to Pro for AI-assisted fixes, compliance mapping and audit-ready exports.
Free
$0
No account needed
- Standard security scans. Scan a file or a whole workspace with CWE-mapped rules, from the CLI or the editor.
- Live checks as you type. The extension checks unsaved edits and re-checks files changed by git, terminals or coding agents.
- Dependency analysis. Declared dependencies checked against OSV.dev advisories, with a local cache from earlier online runs.
- Rule catalog. List every rule and explain what it looks for and why.
- Suppressions with reasons. Suppress a finding and record why in the workspace's .dsc.yml.
- JSON output. Complete scan results as JSON, with CI-friendly exit codes.
- No account, runs on your machine. Standard scans make no network calls and keep working offline.
Pro
$9.99per user per month
14-day free trial, no card, for eligible accounts
Everything in Free, plus:
- AI finding validation. Triage each finding as likely real or a probable false positive, with an explanation.
- AI fix suggestions. A finding-specific fix as a diff you review before it touches your files.
- Local or bring-your-own-key models. Local models through Ollama, including Deva Coder, or your own Anthropic, OpenAI, Gemini or OpenRouter key.
- Compliance mapping. Findings mapped to controls in 7 frameworks: NIST SP 800-53 Rev 5, PCI DSS v4.0, SOC 2 and OWASP Top 10 (2025), plus FedRAMP Rev 5, ISO 27001:2022 and HIPAA in preview.
- Reports and exports. SARIF, JUnit, Markdown, agent-JSON and OSCAL assessment results, plus OSCAL and POA&M compliance exports.
- Signed evidence. Signed evidence packages you can verify, and a tamper-evident evidence history.
- SBOM export. Software bills of materials in CycloneDX and SPDX.
- Deeper scans. Deep and coverage scan profiles and reachability analysis.
Compare plans
| Feature | Free | Pro |
|---|---|---|
| Standard security scans | ||
| Live checks as you type | ||
| Dependency analysis | ||
| Rule catalog | ||
| Suppressions with reasons | ||
| JSON output | ||
| No account, runs on your machine | ||
| AI finding validation | ||
| AI fix suggestions | ||
| Local or bring-your-own-key models | ||
| Compliance mapping | ||
| Reports and exports | ||
| Signed evidence | ||
| SBOM export | ||
| Deeper scans |
Start Pro or a trial
You start a trial or subscribe from inside Deva, signed in with Google, GitHub or email. One account covers the extension and the CLI.
In VS Code, Cursor or Windsurf
- Install Deva Security from the VS Code Marketplace or Open VSX.
- Open the Command Palette and run Deva: Sign In.
- Run Deva: Start Trial, or Deva: Subscribe to Pro to buy.
In the terminal
deva login # Google; --github or --email EMAIL
deva billing trial # one 14-day trial, no card
deva billing checkout # subscribe to Pro through Stripe
deva billing statusNew to the CLI? Get started or download it.
Questions
- Is Deva free?
- Yes. The Free plan includes standard local scans, live checks, dependency analysis, the rule catalog and JSON output, with no account. Pro adds AI-assisted validation and fixes, compliance mapping, exports, signed evidence and SBOM export.
- How much does Deva Pro cost?
- Deva Pro costs $9.99 per user per month. Checkout and billing run through Stripe.
- Is there a free trial of Pro?
- Yes. Eligible accounts can start one 14-day Pro trial without a payment card, from the extension (Deva: Start Trial) or the CLI (deva billing trial).
- Do I need an account to scan?
- No. Standard scans, live checks, dependency analysis, the rule catalog and JSON output work without an account. You sign in only to start a trial or use Pro.
- Does one plan cover the extension and the CLI?
- Yes. Sign in with the same account in the Deva extension and the Deva CLI and both use the same plan.
- How do I cancel?
- Open the Stripe Customer Portal from the extension (Deva: Manage Subscription) or the CLI (deva billing portal). When Pro ends, Free scanning keeps working.
- Does Pro send my code to the cloud?
- Scans and compliance mapping run on your machine. AI features use either a local model, where nothing leaves the machine, or your own provider key, where the prompt and the code context for that request go directly to that provider.
- Do you offer team, offline or air-gapped licensing?
- Contact us at contact@devseccode.com. Pro supports vendor-signed offline entitlements; Deva has no dedicated air-gapped mode yet.
More questions? See the FAQ or email contact@devseccode.com.