Epherem
Security scanning for apps built with AI tools, automatically checking for common security mistakes and providing step-by-step fix guidance.
About Epherem
Epherem is a free security scanning tool for apps built with AI tools. It runs 55 checks to find exposed secrets, publicly readable and writable database tables, missing authentication and ownership checks, and unsafe inputs, and compares your package versions against published security advisories. Reports are grouped into known issues, likely issues, and findings that need manual review, and state which files and languages were analyzed and which were not. Each finding is explained in plain language: what the problem is, how it could be exploited, and how to fix it. Once scanning is complete, the uploaded code is deleted, reports are stored in your account until you delete them, and content such as secrets and passwords is masked.
Best for
Best use cases
Scan projects built with tools like Lovable, Bolt, v0, Cursor, Replit, and Claude Code
Upload a ZIP or connect GitHub to scan a private repository
Check for issues such as database configuration, login permissions, and exposed secrets before launch
Features
Clearly organized reports
Each report groups findings into known, likely, and needs-review categories, and states which files and languages were analyzed and which were not.
Known package vulnerabilities
Package versions matching published security advisories on OSV.dev are listed along with the corresponding advisories; packages with exact versions in a lockfile are checked.
Fix guidance for each finding
Every finding is explained in plain language: what the problem is, what an attacker could do with it, and how to fix it.
Pinpointed to the exact line of code
Reports include file paths, line numbers, and short code excerpts; anything that looks like a secret or password is masked.
Free report export
Every report can be exported for free.
Claude Desktop extension
After installing the extension, you can read scan reports in Claude Desktop.
Pros
- 55 automated checks covering common security mistakes, with packages compared against published security advisories
- Each problem, its impact, and the fix are explained one by one in plain language, ideal for developers who rarely read code
- Uploaded code is deleted after scanning, and secrets and passwords are masked in the report
- Free report export and support for scanning private projects
Cons
- Scanning only covers the code itself; anything outside the code (such as Supabase console settings) is not checked
Pricing Plans
Public Beta Free Plan
- 5 scans per day for each account
- Reports stay in your account until you delete them
- Rescan anytime (subject to the 5-per-day limit)
- Free report export
- Read reports via the Claude Desktop extension
* Pricing information is for reference only. Please refer to the latest announcement on Epherem's official website.