Terms of Service

Last updated: 4 October 2026

Epherem doesn’t catch every issue. Like every scanner, it will miss some. A report with few or no findings doesn’t mean your app is safe to launch.

These Terms are an agreement between you and the operator of Epherem, named in section 17. In these Terms, “we”, “us” and “Epherem” mean that operator, and “the Service” means the Epherem website, the scanner, your reports, the chat and the AI agent page. The Privacy Policy explains what we do with personal data, and is part of these Terms.

After you sign in, you’re asked to read and accept these Terms and the Privacy Policy, and you can’t run a scan until you do. If you don’t agree to them, don’t use Epherem.

1. Who can use Epherem

You must be 18 or older to use Epherem. By accepting these Terms, you confirm that you are. We don’t ask for your age at sign-up, but we may close an account that we learn belongs to someone under 18.

If you use Epherem for a company or another organisation, you confirm that you’re allowed to accept these Terms for it.

2. Your account and signing in

You sign in with Google, or with a one-time code sent to your email address. You need a confirmed email address to run a scan.

Keep your sign-in safe: your email account, your Google account if you use it, and any key you create on the AI agent page (section 7). You’re responsible for what happens under your account. If you think someone else has got into it, tell us at support@epherem.com.

Don’t create extra accounts to get around the limits in section 5.

3. What Epherem does and doesn’t do

You give Epherem code in one of two ways: you upload a ZIP of your project, or you connect GitHub and choose a repository (section 6). Epherem unpacks the code, reads it with fixed rules, and checks the package versions your project uses against OSV.dev, a public database of security advisories. It then gives you a report: possible issues with the file, the line, a short excerpt, an explanation and a suggested fix, the advisories that match your packages, and what the scan couldn’t check.

No AI reads your code. The scan uses fixed rules, not an AI model.

Epherem reads your code. It doesn’t run it, visit your live app, or see settings kept outside your code, such as your database dashboard. It works best on JavaScript and TypeScript and covers Python in part; other languages are listed in the report as not analysed.

Findings are not verified. Each one is a place to look, not proof of a problem: check each one before you change code. Epherem is not a security audit or a penetration test, and it doesn’t make your app secure.

Epherem never changes your code, and it doesn’t watch your app. Each scan reads your code as it is when you start that scan. We change the rules, the advisory data and the report as we improve Epherem, so scanning the same code again can give a different report.

4. Your code and your responsibility

Your code stays yours. You allow us to copy, unpack and read it only to run the scans you ask for, to keep your reports in your account and show them to you, and to look at them as the Privacy Policy describes in “Looking at accounts”.

You may scan only code you own or have permission to scan. Don’t use Epherem to find weaknesses in someone else’s app in order to attack it. If you scan code you have no right to scan, you alone are responsible for that.

Your reports are yours to keep, share and use, including copies you export. The scanner, its rules, the report’s design and the website stay ours. If you send us ideas or feedback, we may use them to improve Epherem without paying you.

5. Free use and limits

The basic scan is free. If we ever start charging for something you use for free today, we’ll tell you at least 30 days before.

Today’s limits are:

• 5 scans a day. The day starts at 00:00 UTC, which is 08:00 in Singapore.
• One scan at a time.
• A ZIP can be up to 100 MB, and you can upload up to 4 GB a day.
• A project can have up to 5,000 source files, and up to 1 GB once unpacked.
• A scan stops after 5 minutes.

We may give an account higher limits, for example for testing. We may change these limits, and we may refuse or stop a scan, to keep Epherem working for everyone.

6. GitHub

You can connect a personal GitHub account by installing the Epherem GitHub App and choosing which repositories it may read. Repositories that belong to an organisation can’t be connected; upload a ZIP of those instead. GitHub’s own terms apply to your use of GitHub.

Epherem only reads from GitHub. It never writes to your repositories, opens pull requests or changes your code. When you scan a repository, Epherem downloads a copy of it, scans it, and deletes the copy when the scan ends. The report records which repository and commit it read.

Disconnect, on the GitHub page in Epherem, removes the connection and uninstalls the App from your GitHub account, unless another Epherem account still uses the same installation. Your apps and reports stay. You can also uninstall the App in your GitHub settings at any time.

7. The AI agent page

On the AI agent page you can create a key that lets an AI tool, such as Claude Desktop, read your reports. The tool can list your apps and scans and read your reports. It can’t start a scan or change anything.

Treat a key like a password: anyone who has it can read your reports. We keep a fingerprint of each key (a SHA-256 hash) and its first 12 characters, not the whole key, so we can’t show it to you again. You can have up to 5 keys at a time, and you can delete one on the AI agent page whenever you like. It stops working at once.

What your AI tool does with your reports, including the code excerpts in them, is between you and the company that makes it, under your own agreement with that company. Reports quote your code, so they can contain text written by whoever wrote that code. Check what your AI tool suggests before you act on it.

8. Chat with the operator

When you’re signed in, you can write to the operator in the chat. Your messages reach the operator through Telegram, and replies come back in the chat. We usually reply within a day, Singapore time, but we don’t promise a reply time.

If a reply stays unread for 30 minutes, we email you about it, at most once a day. We will never ask you for your password, a sign-in code or a key from the AI agent page.

We may stop an account from using the chat if it’s misused.

9. Acceptable use

Don’t, and don’t help anyone else to:

• scan code you have no right to scan, or use Epherem to find weaknesses in apps in order to attack them;
• attack, probe or overload Epherem, or try to get into anyone else’s account or data;
• get around the limits, for example with several accounts or with scripts;
• upload malware, or anything you’re not allowed to have or share;
• copy Epherem’s scanner, or offer Epherem to others as your own service;
• present a report as a security audit, a certification or a guarantee; or
• use Epherem in a way that breaks the law.

10. Suspending and closing accounts

You can stop using Epherem at any time, and delete your account in Settings.

We close an account immediately, without notice, for abuse. Abuse includes attacking the Service, scanning code you have no right to scan, and getting around the limits with several accounts.

We may also suspend or close any account at our discretion. Where it’s practical, we’ll tell you first.

If we shut Epherem down, we’ll email every account at least 30 days before, so you have time to export your reports.

11. Disclaimers

Epherem is provided “as is” and “as available”. We don’t promise that it will find every issue, that its findings are right, or that it will always be available or free of errors.

Epherem doesn’t verify its findings. It is not a security audit or a penetration test, and a report is not advice from a security professional. You decide what to change in your code, and you are responsible for your app.

As far as the law allows, we make no other promises about Epherem, stated or implied. Any rights that the law doesn’t allow us to exclude still apply.

12. Liability

As far as the law allows, we are not liable for any loss or damage that comes from using Epherem or from relying on a report. That includes lost profits, lost data, and security incidents in your app.

Where we are liable anyway, our total liability to you is at most SGD 100.

Nothing in these Terms limits liability that the law doesn’t allow to be limited, such as liability for fraud, or for death or personal injury caused by negligence.

13. Claims about what you upload

If someone makes a claim against the operator because of code you uploaded or connected, or because you used Epherem against these Terms, you will cover the operator’s resulting losses and reasonable legal costs, as far as the law allows.

14. Changes to these Terms

When we make a real change to these Terms, we’ll email every account, and the change takes effect 14 days later. If you don’t agree, you can delete your account before then. We may also ask you to accept the new Terms in the app before your next scan.

A fix to the wording that doesn’t change what the Terms mean only changes the “Last updated” date.

A change needed urgently for a legal or security reason can take effect immediately.

15. Moving Epherem to a company

The operator may move Epherem, including these Terms, your account and its data, to a company the operator forms to run it. We’ll email you before that happens. You can’t transfer your account or these Terms to anyone else.

16. Law

The law of Singapore governs these Terms. The courts of Singapore decide any dispute about them, unless the law where you live gives you a right to bring a claim there.

If part of these Terms can’t be enforced, the rest still applies.

17. Who provides Epherem

Epherem is provided by Kirtik Jaikanth, an individual in Singapore, under the name Epherem.

Write to support@epherem.com about anything: support, privacy requests and legal notices. We send notices to the email address on your account.