Finding code vulnerabilities
801K visits/mo-5.7%#97 Coding & Development
Epherem
Static security scanner for AI-built applications identifying vulnerabilities before deployment
FreeStarting price
About Epherem
Epherem scans applications built with AI development tools such as Lovable, Bolt, v0, Replit, Cursor and Claude Code for security vulnerabilities across codebases, settings files and package dependencies. The tool analyzes projects uploaded as ZIP files or connected via GitHub without executing the application itself. It performs 55 checks including detection of hardcoded secrets, SQL injection risks, missing CSRF protection, unsafe input handling and package vulnerabilities against published advisories. Each finding is categorized as known issues, likely issues or findings needing manual verification, with exact file locations and line numbers provided. Reports explain what is wrong, what an attacker could do, and how to fix it, including prompts compatible with Cursor, Lovable or Claude Code for automated remediation. The scanner distinguishes between code it analyzed and elements it could not read, ensuring reports never falsely claim a clean scan.
Key features
- 55 vulnerability checks
- ZIP or GitHub project upload
- Package advisory matching
- Three-tier finding categorization
- AI tool integration prompts
- Exact file and line identification
- Layered scanning of code, settings and packages
- Plain-language vulnerability explanations
Use cases
- Scanning AI-built applications before deployment
- Identifying hardcoded secrets in configuration files
- Checking package dependencies for known vulnerabilities
Pros
- Static analysis without executing code
- Detailed remediation prompts for AI tools
- Categorizes findings by severity and confidence
- Checks package dependencies against advisories
- Provides exact file and line references
Cons
- Limited to specific AI development tools
- Does not analyze Go files
- Requires manual key rotation for some fixes
- No API access mentioned
Frequently asked questions about Epherem
What is Epherem and what does it do?
Epherem is a free security scanner designed for applications built using AI development tools like Lovable, Bolt, v0, Replit, Cursor, and Claude Code. It scans codebases, settings files, and package dependencies for security vulnerabilities without executing the application itself.
Who should use Epherem?
Epherem is ideal for developers and teams building software with AI tools who want to identify and remediate security risks before their applications reach production. It is particularly useful for those using platforms like Cursor, Lovable, or Claude Code.
How does Epherem scan applications?
Users can upload their project as a ZIP file or connect via GitHub. Epherem reads the code, settings files, and package list to perform 55 checks for vulnerabilities such as hardcoded secrets, SQL injection risks, and missing CSRF protection.
What kind of vulnerabilities does Epherem detect?
Epherem detects a range of vulnerabilities including hardcoded secrets, SQL injection risks, missing CSRF protection, unsafe input handling, and package vulnerabilities by checking against published advisories.
How does Epherem categorize its findings?
Findings are categorized as known issues (published advisories), likely issues (risky code detected by the scanner), findings needing manual verification, and elements the scanner could not read. This ensures reports never falsely claim a clean scan.
Can Epherem help fix the vulnerabilities it finds?
Yes, each finding includes a prompt compatible with AI tools like Cursor, Lovable, or Claude Code to assist with automated remediation. Users can paste the prompt into their AI tool to generate fixes, though some actions like rotating leaked keys must be done manually.
