Launching today

Epherem

Launching today

Find login and database flaws in your AI-built app

32 followers

Find login and database flaws in your AI-built app

32 followers

•

•

Epherem is a free source code security scanner for apps built with AI. It checks for common security issues involving authentication, database access, exposed API keys and vulnerable packages. Upload a ZIP or connect a GitHub repository to scan your app. Findings include plain-English explanations, suggested fixes and prompts you can paste into Claude Code, Lovable or Cursor. Reports can also be exported for review with your AI coding assistant, including issues the scanner couldn't verify.

Interactive

Free

Launch tags:Developer Tools•GitHub•Vibe coding

Launch Team / Built With

Google Cloud Run

Google Cloud Run Hackathon

How did you use Cloud Run for this launch?

Epherem

Maker

Epherem’s backend is a single Node.js/TypeScript service on Google Cloud Run (asia-southeast1). When someone uploads a ZIP or connects a GitHub repo, the code goes to a short-lived Cloud Storage bucket, and a Cloud Run instance unpacks it into an in-memory disk, never onto permanent storage. It runs the security checks there and deletes the code as soon as the scan finishes; only the report is kept. Each instance handles one scan at a time, so one user’s code is never processed alongside another’s. Cloud Run keeps one instance warm, so scans start without a cold-start delay, and scales out to 30 instances under load, then back down. This means we pay for compute only while scans are running. Cloud Scheduler calls the same service every 5 minutes to clean up and retry anything that failed, and once a day to send our internal summary email.

Report

9h ago

Epherem

Maker

📌

Hey Product Hunt! I'm launching Epherem today, a free source code security scanner for apps built with AI! The idea came about when I was preparing to launch another product, a marketplace for university students and SMEs. As I was getting ready to ship, I started looking into the security risks of AI-built applications, and honestly, some of what I found was pretty concerning. I tried a few security scanners, but most seemed to be made for experienced developers. I could run the scans, but I often struggled to understand the findings or what I was supposed to do about them. The simpler tools I found mostly scanned URLs rather than the actual source code. So I decided to build Epherem. After four months of working on it, I've finally released the first version! Here's what it does: - Scan your source code through GitHub or a ZIP upload. - Check for common security issues, exposed secrets and vulnerable dependencies. - Get explanations of the findings, suggested fixes and prompts you can give to Claude Code, Lovable or Cursor. - See what the scanner couldn't check, and export your report. It's not a replacement for a professional security audit, but I hope it'll be a useful starting point for people building and shipping applications with AI. I initially planned to charge for the scanner, but decided to make it free during early access. Right now, I'm also trying to better understand how people building with AI approach security. I'd love to speak with anyone who's launched an AI-built application, hear about their experiences, and understand what they've struggled with. I'd be happy to personally walk you through a free scan of your application in return. I'd also really appreciate any feedback on Epherem itself, particularly what you think could be improved. Thanks for checking it out!

Report

2d ago

SonOf

Kirtik, keeping the checks you couldn't verify in the exported report is a useful detail. The prompt for a fix and the limits of the scan should travel together when it goes back to the coding agent.

Report

8h ago

Epherem

Maker

@oleksii_sekundant That's a really good point, thanks for bringing it up!

The full Markdown, PDF and JSON reports already include what the scanner couldn't verify, so users can pass that context back to their coding agents alongside the findings.

But you made me realise something I overlooked: the individual "Copy fix prompt" button doesn't carry those limitations with it.

I'll be updating that so the context stays attached even when someone copies just a single finding. Really appreciate you pointing this out!

Report

8h ago

Mailwarm

💎 Pixel perfection

Really handy that Epherem scans an AI-built app for login and database flaws, since that is exactly the stuff I tend to miss when I ship fast.

Report

7h ago

Epherem

Maker

@karimbenkeroum Thanks Kareem! That's exactly what pushed me to build Epherem! AI has made it so much easier to ship apps, but it's still pretty easy to overlook what's happening under the hood, especially with authentication and databases.

Really appreciate you checking it out and supporting the launch! :)

Report

2h ago

FetchSandbox

💎 Pixel perfection

Love that you're attaching the caveats to the fix prompt instead of just the clean fix text. That's the detail most tools skip and then wonder why people blindly paste AI suggestions into prod. Congrats on the launch!

Report

2h ago

Epherem

Maker

@rnagulapalle Thanks Raj! Really appreciate you noticing that :)

That's exactly what I was going for. I wanted people to have the context and limitations alongside the suggested fixes, rather than blindly pasting prompts into Claude and assuming everything's secure.

I also had a look at FetchSandbox :)
Really interesting how you're approaching API testing, especially beyond the usual happy-path scenarios.

Thanks again for the support!

Report

2h ago