Epherem

Epherem is a free source code security scanner for apps built with AI. It is made for people building with tools such as Lovable, Bolt, v0, Replit, Cursor and Claude Code, and it is especially aimed at builders who do not read much code themselves. You upload your project or connect a repository, and Epherem reports the security mistakes it finds in your code, each with a suggested fix and a prompt you can paste into your own AI coding assistant. The product is in early access and is free while it is being built. Most apps built with AI assistants are created quickly, and the same handful of failures show up again and again at ordinary trust boundaries. Epherem's own research review, What actually goes wrong in vibe-coded apps, draws on seventeen sources that describe the same recurring problems, and its security checklist distils that work into fourteen checks worth running before real users arrive. The problem Epherem addresses is straightforward: people building with AI tools often ship without a security review, particularly when they do not read much code themselves, and the mistakes that matter are usually common ones such as exposed keys, open database rules, missing login and ownership checks, and unsafe input handling. Scanning starts with your project. You upload a ZIP of your app or connect GitHub and choose a repository, including a private one. Epherem reads your source code, your settings files and your package list, and it never runs your app. The scanning is layered, meaning your code, your settings files and your packages are each checked, and findings point to the exact file and line where the problem sits. Each scan produces a new report of your code as it is right now, so the recommended loop is to change something and then scan again. The scanner runs 55 checks that look for exposed keys, open database tables, missing login and ownership checks, and unsafe input. A settings-file finding might be an open Firebase rule such as allow read, write: if true; at a named line, and a code finding might be an SQL injection or a hardcoded secret with the file that contains it. On top of the code checks, your packages are checked against published advisories. Packages with exact versions, taken from a lockfile, are matched against advisories such as GHSA-fr5h-rqp8-mj6g for next 14.1.0, GHSA-wf5p-g6vw-rhxx for axios 1.5.1 and GHSA-qwph-4952-7xr6 for jsonwebtoken 8.5.1. If there is no lockfile, the report says which packages it could not check. Every report sorts what was found into four groups. Known issues are published advisories that match a package version you use. Likely issues are the ones where the scanner saw the risky code itself, and these are the ones to start with. Findings that need checking are cases where Epherem looked for a protection and did not see it, or where the match depends on context it cannot see, so the protection may exist somewhere the scan could not look. Anything it could not read is named in the report and never counted as clean. Each finding also shows the file, the line and the code, and explains what someone could actually do with it, so you know where to start. Findings are written for whoever built the app. Each one says in plain words what is wrong, then what someone could do with it, how to fix it, and the file and line. Because Epherem never changes your code, the fix arrives as a prompt for Cursor, Lovable or Claude Code that you paste into your AI tool, let it make the change, and then scan again. A typical finding might explain that a Supabase service-role key sits in code the browser downloads, describe how anyone opening the site could copy that key and read, change or delete every row, recommend using the anon key in browser code and keeping the service-role key in a server-only variable, and then supply a prompt that lists the files it changed. Epherem also notes which steps still need you: your AI tool cannot rotate a leaked key, so that part is done yourself in your Supabase dashboard. The free scan works with fixed checks and a public advisory database, and no code is sent to an AI. Uploaded code is used only to run the scan and is then deleted, while your report is kept in your account until you delete it. That report contains file paths, line numbers and short code excerpts, with anything that looks like a key or password masked. Epherem is direct about its limits. It will not make your app hack-proof, and no scanner can show that an app is secure. It points out common mistakes and tells you what it could not check. It reads your code without running your app, so it cannot confirm a code finding for you, and it cannot see your live site or settings outside your code, such as your Supabase dashboard. It works best on JavaScript and TypeScript, Python is partly covered, and other languages are listed in your report as not analysed. Every report states what was not checked, so a quiet report never pretends to be a clean one. The natural workflow is to scan before you deploy, see what your AI may have left exposed, fix it with your AI tool, and then scan again. That loop suits the people Epherem names as its audience: vibe coders, indie hackers, AI builders, solo founders, startup teams and weekend shippers. You do not need to know about security to use it, because each finding explains in plain words what is wrong, what someone could do with it and how to fix it, and the guides, research articles, security checklist and docs linked from the site go deeper if you want the background. Access is simple. Epherem is free during early access, each account can run 5 scans a day, and you can sign in and scan your app free. The site states that if the pricing ever changes it will say so there first, and that Epherem will never charge you unless you choose to pay. Epherem gives AI-assisted builders a way to ship with their eyes open: a free, plain-English scan of the code, settings and packages an AI wrote for them, a suggested fix and a copy-ready prompt for the AI tool that wrote it, and an honest list of everything the scan could not check.