Static code and configuration checks
The scanner applies 55 checks to source code and configuration-related files, covering access controls, exposed keys, unsafe input handling, security settings, and other common mistakes in AI-built web apps.
Epherem
Epherem is a static security scanner for web apps built with AI coding tools such as Lovable, Bolt, v0, Replit, Cursor, and Claude Code. It checks source files and dependencies for common security mistakes, then provides categorized findings and suggested fixes without running the app.
Security scanning for AI-built web applications
Epherem is a static security scanner for web applications built with AI coding tools. It accepts a ZIP upload or a connected personal GitHub repository, reads the project files, and checks for common security mistakes without running the application.
The service is designed as an early check before an AI-built app reaches real users. It examines access controls, secrets, input handling, settings, and dependency advisories, then produces a report that separates confirmed package advisories from code findings that require review and areas it could not analyse. It also provides repair prompts for supported AI coding tools, while leaving actions such as rotating an exposed key to the developer.
Security scanning features
Language-aware analysis
JavaScript and TypeScript receive the deepest coverage, Python is partly covered, and unsupported languages are identified in the report rather than being presented as clean.
Dependency advisory checks
Exact package versions from lockfiles are checked against OSV.dev, a public database of published security advisories. Missing lockfile coverage is reported.
Categorized findings
Reports classify results as known issues, likely issues, findings that need checking, and items not analysed, helping readers distinguish advisory matches from code patterns and coverage gaps.
Actionable reports
Each finding explains the issue in plain language, identifies the file and line, describes what someone could do, and suggests how to fix it. Code excerpts mask apparent keys and passwords.
AI-assisted remediation workflow
Findings can include prompts for Cursor, Lovable, or Claude Code. After making changes, users can run another scan to create a new report of the current code.
Practical use cases
Review an AI-generated app before launch
Upload the complete project, including backend code, environment-related files, database rules, and a lockfile, to catch issues that may not appear in the visible interface.
Audit a project after rapid iteration
Connect a personal GitHub repository and use the report to inspect authentication, ownership checks, exposed credentials, and unsafe data access in an existing project.
Turn findings into focused code changes
Use the file-and-line findings and generated prompts to guide Cursor, Lovable, or Claude Code through a targeted repair, then rescan the changed code.
Review package risk
Use the dependency section to check exact versions from a lockfile against published advisories, especially when an AI coding tool has added or updated packages.
Establish review boundaries
Read the not-analysed and needs-checking sections before treating a quiet report as reassuring, and identify areas that require manual review or a different security process.
Pros and Cons
Pros
- Free access is available during early access, with five scans per account per day.
- Reports identify exact files and lines, explain potential impact, and provide suggested fixes.
- The workflow supports ZIP uploads and personal GitHub repositories, with scan history grouped by app.
- The scan does not run the application, install its packages, connect to databases, or send code to an AI.
Cons
- It is an automated first check, not a penetration test or proof that an application is secure.
- Coverage is strongest for JavaScript and TypeScript; Python has less depth and other languages may be listed as not analysed.
- The scanner reads code only, so it cannot verify live behavior, database state, hosting configuration, or dashboard settings outside the project files.
FAQ
How do I scan a project?
Upload a project ZIP or connect a personal GitHub repository, then start a scan. Email confirmation is required before the first scan. Epherem creates an app entry for the project and keeps scan reports in its history.
What are the scan limits?
Each account can run five scans per day, with one scan running at a time. A scan stops after five minutes. ZIP uploads can be up to 100 MB, with limits of 20,000 entries, 5,000 files, and 1 GB unpacked.
Is Epherem a penetration test or a guarantee that an app is secure?
Epherem reads source code and configuration-related files without running the app, visiting the live site, logging into a database, or installing packages. It cannot assess behavior or settings outside the code it can read, and unanalysed code is listed rather than treated as clean.
What does a scan report contain?
Reports separate package advisories classified as known issues from code patterns classified as likely issues or findings that need checking. They also identify files or areas that were not analysed, and findings include file paths, line numbers, explanations, impact, and suggested fixes.
Does Epherem use AI to analyse or fix my code?
No code is sent to an AI by the free scan. For supported findings, Epherem provides a prompt that you can paste into Cursor, Lovable, or Claude Code; key rotation and other external actions still need to be completed manually.
Quick Facts
- Category
- Developer tool; application security scanner
- Primary users
- People building web apps with AI coding tools
- Inputs
- Project ZIP files or personal GitHub repositories
- Coverage
- 55 checks; strongest for JavaScript and TypeScript, partial for Python
- Dependency source
- OSV.dev published advisories for exact package versions
- Early-access usage
- Free; five scans per account per day
Alternatives à Epherem
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repositories and verifies changes with the real compiler, debugger, sanitizers, and tests before showing a diff. It offers a free tier plus paid plans, with editor connectors and zero-retention handling described in the source.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads inside Firecracker micro-VMs. It is designed for workflows that need machine-level isolation, private networking between sandboxes, and programmatic control through SDK, CLI, or MCP.
GitBot
GitBot is a local browser-based workspace for creating reusable coding bots powered by Claude Code, Codex, or OpenCode. It helps developers run those agents across repository folders with persistent threads and configurable permissions.
hob
hob is an independent workspace for coding agents that keeps agent sessions, terminals, history, and follow-up work organized around the tools and providers you already use. It is aimed at developers who want local control over routing, history, and workspace structure rather than a bundled model stack.
Ably Chat
Ably Chat is a chat API platform for building custom realtime chat applications. It supports room-based messaging, typing indicators, presence, reactions, and message updates, with usage-based pricing options for different deployment stages.
Exodus
Exodus is a free developer tool that audits an application repository, compares its current deployment with a Google Cloud Run design, and creates an ordered migration plan for a coding agent. It also helps plan new products for Cloud Run with architecture and cost estimates.