Epherem
The free source-code security scanner for apps built with AI
46 followers
The free source-code security scanner for apps built with AI
46 followers
Epherem is a free source code security scanner for apps built with AI. It checks for common security issues involving authentication, database access, exposed API keys and vulnerable packages. Upload a ZIP or connect a GitHub repository to scan your app. Findings include plain-English explanations, suggested fixes and prompts you can paste into Claude Code, Lovable or Cursor. Reports can also be exported for review with your AI coding assistant, including issues the scanner couldn't verify.
Kirtik, keeping the checks you couldn't verify in the exported report is a useful detail. The prompt for a fix and the limits of the scan should travel together when it goes back to the coding agent.
@oleksii_sekundant That's a really good point, thanks for bringing it up!
The full Markdown, PDF and JSON reports already include what the scanner couldn't verify, so users can pass that context back to their coding agents alongside the findings.
But you made me realise something I overlooked: the individual "Copy fix prompt" button doesn't carry those limitations with it.
I'll be updating that so the context stays attached even when someone copies just a single finding. Really appreciate you pointing this out!
Really handy that Epherem scans an AI-built app for login and database flaws, since that is exactly the stuff I tend to miss when I ship fast.
@karimbenkeroum Thanks Kareem! That's exactly what pushed me to build Epherem! AI has made it so much easier to ship apps, but it's still pretty easy to overlook what's happening under the hood, especially with authentication and databases.
Really appreciate you checking it out and supporting the launch! :)
Love that you're attaching the caveats to the fix prompt instead of just the clean fix text. That's the detail most tools skip and then wonder why people blindly paste AI suggestions into prod. Congrats on the launch!
@rnagulapalle Thanks Raj! Really appreciate you noticing that :)
That's exactly what I was going for. I wanted people to have the context and limitations alongside the suggested fixes, rather than blindly pasting prompts into Claude and assuming everything's secure.
I also had a look at FetchSandbox :)
Really interesting how you're approaching API testing, especially beyond the usual happy-path scenarios.
Thanks again for the support!