Give it your code
Upload a ZIP of your project, or connect GitHub and pick a repository.
From your code to a report.
You give Epherem your code in one of two ways. It checks the upload is safe to open, reads the files that matter, and writes up what it found. Your uploaded code is deleted after the scan; only the report is kept.
Check the upload
ZIP bombs, encrypted archives and files that try to escape their folder are refused.
Skip the noise
Installed packages, build output, caches and media are skipped.
Read and look up
55 checks read your code. JavaScript and Python packages with exact versions (from a lockfile) are looked up on OSV.dev, a public database of known issues. Without a lockfile, the report says which ones it couldn’t check.
Report
You get known issues, likely issues, what needs checking, and what the scan couldn't check.
What it can read well, and what it can't.
Epherem is built for the web apps AI coding tools produce. It reads some languages better than others, and the report says which parts of your project it analysed. Code it didn't analyse is never reported as clean.
JavaScript and TypeScript
The most checks apply here. Some ways of writing routes can't be read yet; when that happens, the report names the routes it couldn't read.
- React and Next.js
- Node.js and Express
- Supabase and Firebase
Python
Checked with less depth. Some checks written for JavaScript don't apply, so fewer problems can be found.
- FastAPI
- Flask
- Django
Everything else
Other languages are named in the report as not analysed. So is anything that isn't in your code.
- Java, PHP, Ruby, Go and C#
- Supabase dashboard settings
- Your live site and hosting
What the 55 checks look for.
Each check was written for a mistake that shows up in apps built with AI tools. The report explains every finding in plain words: where it is, what someone could do with it, and how to fix it.
01
Who can see and change your dataPages and actions with no login check, users who can reach other users' records, database tables anyone can read.
02
Keys and secretsAPI keys written into code, secret keys that end up in the browser, .env files and credential files included with the project.
03
How your app handles inputForm or URL input that reaches a database query, a shell command, a file path or the page itself without being made safe.
04
Settings and packagesMissing security headers and rate limits, other sites allowed to call your API, and package versions with a published advisory.
Secret keys that reach the browserKEYS
Tables without row-level securityDATABASE
Actions that don't check who is signed inACCESS
Users able to change other users' recordsACCESS
Input that reaches a query or command unsafelyINPUT
Packages with a known advisoryPACKAGES
What it knows, and where to look.
Known issues are packages where a published advisory matches the version you use. Likely issues are where the scanner saw the risky code itself. Findings that need checking are where it looked for a protection and didn’t see it, or where the match depends on context it can’t see. Epherem reads your code but never runs your app, so it can’t confirm a code finding for you.
Known issuesA published advisory matches a package version you use
Likely issuesThe scanner saw the risky code itself. Start here.
Needs checkingIt looked for a protection and didn’t see it, or the match depends on context it can’t see. It may exist somewhere the scan couldn’t see.
Not checkedNamed in your report, never counted as clean
Read-only, with clear limits.
Epherem is an automated first check, not a penetration test. It works only from your code, so it can't see how your live site behaves or how your services are set up outside the code.
Free scan limits
- 5 scans a day
- Uploads up to 100 MB
- Up to 20,000 entries, 5,000 files and 1 GB unpacked
- Files over 1 MB are skipped, and listed in the report
- You can leave
node_modulesin. The page leaves it out before uploading, along with build output and other folders Epherem skips. - A scan stops after 5 minutes
- You confirm your email before your first scan
What it never does
- Run your app or install its packages
- Change your files
- Connect to your database
- Send your code to an AI
- Say your app is secure
55Security checks
5 a dayFree scans
5 minLongest a scan runs
OSV.devPackage advisories