Launching today
Epherem
Find login and database flaws in your AI-built app
21 followers
Find login and database flaws in your AI-built app
21 followers
Epherem is a free source code security scanner for apps built with AI. It checks for common security issues involving authentication, database access, exposed API keys and vulnerable packages. Upload a ZIP or connect a GitHub repository to scan your app. Findings include plain-English explanations, suggested fixes and prompts you can paste into Claude Code, Lovable or Cursor. Reports can also be exported for review with your AI coding assistant, including issues the scanner couldn't verify.
Products used by Epherem
Explore the tech stack and tools that power Epherem. See what products Epherem uses for development, design, marketing, analytics, and more.
Engineering & Development 3
Engineering & Development 3
Cloudflare PagesBuild Fast Sites. In Record Time.
5.0 (29 reviews)
Also considered:
NetlifyI considered Netlify initially, but Cloudflare Pages ended up being a much better fit for me, especially as a solo founder building on a budget.
As a developer, I've probably deployed the frontend close to 200 times by now. Being able to constantly push changes, test things, break things, and redeploy without worrying about burning through deployment credits has been a huge advantage.
With Netlify's credit-based pricing, I was concerned about how repeated deployments would add up. Cloudflare Pages let me keep iterating without having to think about that.
The GitHub integration is also really convenient. I can push changes and have the site automatically redeploy without doing much manually. Overall, it's been reliable, easy to use, and surprisingly generous for a free service.
Now, the tips :))
A few things I've learned while building Epherem:
1. Use preview deployments before pushing major changes to production. It's much better to catch a broken layout or feature on a preview URL than on your website - Especially if it's already live!
2. Be careful with environment variables. Anything bundled into your frontend code can potentially be inspected by visitors. Never put private API keys, database service-role keys, or other secrets in client-side code. Again, this can be checked for by running it through security scans such as Epherem
4. Don't confuse hosting with application security. Just because your site is hosted on Cloudflare doesn't mean your authentication, database permissions, or API endpoints are automatically secure. Those still need to be checked separately.
My biggest tip is to take advantage of how easy it is to deploy, but don't skip testing just because pushing changes is convenient. Keep checking, as much as you can. When you add a feature or worked on something touching auth or databases, run a scan at least once before launch.
Claude CodeAnthropic’s deep-context AI coder
5.0 (788 reviews)
Also considered:
Codex 3.0 by OpenAII chose Claude Code because I wanted something that could actually work on my codebase, rather than just generate snippets for me to copy around. I'm building Epherem solo, and it's helped me go from ideas to working features, debug issues, and make changes much faster. Being able to iterate on the actual project without constantly switching between tools has been a huge advantage.
A tip when it comes to any LLM being used by developers developing an app is, while Claude.md exists, make your own word document that lists all the changes and updates done to your repo. It's a simple instruction to ask claude to ammend to it, but it rewards greatly, since whenever something goes wrong, Claude doesn't just have to rely on it's memory but has an overview of all the things it did in the past to gather information from.
An alternative I considered was Codex. While Codex (ChatGPT) is extremely good at research and creativity, it takes up too many tokens to code. Hence, a combination of the two is the best method I've found so far!
SupabaseThe open source Firebase alternative
5.0 (910 reviews)
For Epherem, supabase has been a big part of the backend. Having authentication, a Postgres database, and a dashboard all in one place made it much easier to get started without managing everything separately.
I also really like how well documented everything is. When you're building a product solo, being able to find what you need and get things working quickly makes a huge difference.
There's still a learning curve, especially around security and permissions, but overall it's made building and maintaining Epherem much more manageable.
A few things I'd recommend, especially if you're building with AI coding tools:
1. Enable Row Level Security (RLS) on every table exposed through the API. Don't assume authentication alone protects your data.
2. Actually test your RLS policies. Just because users have to sign in doesn't mean they can't access someone else's records. Try accessing another user's data and make sure it's denied.
3. Never expose your service_role key in frontend code. It can bypass RLS and should only be used in trusted backend environments.
4. Check your storage bucket policies too. It's easy to overlook file access permissions while focusing on database security.
5. Don't blindly trust AI-generated policies. Review and test them, especially before launching with real users.
Supabase provides great security tools, but you still have to configure them correctly. That's probably the biggest lesson I've learned working on Epherem. Ironic - Epherem was built to catch these kinds of vulnerabilities and it helped itself catch them.
LLMs 1
LLMs 1
ChatGPT by OpenAIGet answers. Find inspiration. Be more productive.
4.9 (752 reviews)
Also considered:
Claude by AnthropicI've been using ChatGPT Plus extensively while building Epherem, mostly for research, brainstorming, and working through product and business decisions.
I also tried Claude for research, but I found that ChatGPT generally gave me more comprehensive answers, especially when I needed to dig deep into a particular topic. With Claude, I sometimes found the information less detailed or a little outdated, so I gradually started relying on ChatGPT more for research.
One thing I particularly appreciate is being able to have long conversations where I can challenge an answer, explore different perspectives, and refine an idea rather than just accepting the first response.
It's helped me research competitors, understand unfamiliar technical concepts, explore potential customer problems, and learn about distribution and marketing. Building a product solo means constantly making decisions in areas you're unfamiliar with, and having something to work through those decisions with has been incredibly useful.
Tips!
1. Don't just ask for answers. Challenge them. If you're researching a market or evaluating a business idea, ask ChatGPT to argue against your assumptions and identify what could go wrong.
2. Use deep research for topics that actually warrant it. I've found it especially useful for competitor analysis, market research, and understanding industries I'm unfamiliar with. Ask for sources so you can verify the findings yourself.
3. Ask it to teach you, not just do things for you. Ask for explanations and examples until you actually understand them.
4. Be careful with overly agreeable answers. An AI telling you your idea is great doesn't mean customers will pay for it.
My biggest takeaway is to use ChatGPT as a research and thinking tool, not as a replacement for your own judgment. It's helped me learn considerably faster, but ultimately you still need to go out and test things in the real world.