Launching today
Pharon
Security incident alerts for your whole stack
2 followers
Security incident alerts for your whole stack
2 followers
Pharon is a warning system for software teams. It keeps an inventory of every package, container image, GitHub Action, runtime and cloud service you run, and alerts you within minutes when a compromised release, an exploited vulnerability, a vendor breach or an end-of-life deadline reaches it.
Free Options
Launch Team
Customer.ioAutomate Messaging Everywhere — Startups Get 12 Months Free
Promoted
Hi Product Hunt 👋 I kept watching teams learn about a compromised package or a vendor breach from social media, then spend days working out whether it touched them. I wanted that answer to arrive first. Every week brings a new one: a compromised npm or PyPI release, a hosting provider telling customers to assume their environment variables were stolen, an exploited CVE in a runtime. Finding out is easy. Knowing which of your repos and machines are affected, and which secrets to rotate, is the slow part. Pharon does that part: • A Claude Code plugin and zero-dependency CLI scan your repos on your machine. Only an inventory leaves it: package names, versions and file paths. Never source code or secret values, and you approve the first upload. • Every 5 minutes, new incidents from OSV.dev, CISA's exploited-vulnerability list, endoflife.date and security news are matched against that inventory. The team that owns an affected repo gets an email, Slack message or signed webhook. • In Claude Code, a warning light sits in your status line (🔦 critical · 1 open) and pops up the moment a new critical incident hits the repo you're in. It comes with the plugin. • /pharon:check-incident <id> then checks a machine locally, read-only, and tells you whether it's affected and which secrets to rotate, by name only. • A GitHub Action keeps the inventory fresh from CI and flags pull requests that add an affected version. The client is open source (Apache-2.0). Plans start at $49/month for 25 projects, with a 7-day trial. I'd love to hear what you'd want it to watch that it doesn't yet. I'm here all day.