Security scanner for AI-built apps
Your app can work perfectly and still leave data, keys, and payments exposed. Ephyra finds the dangerous mistakes hiding in your repo—and gives you a fix list your coding tool can use right away.
Read-only access. Your code is not kept after the scan. Your report is.
THE BLIND SPOT
Working software can still leak — Your app can boot, log in, and serve traffic while exposing credentials, data access, and payment paths in ways a code reviewer would never catch by clicking through the live app.
HOW IT WORKS
Read-only access. Your code is not kept after the scan.
Ephyra follows the paths that expose data, leak secrets, weaken login, and leave paid features open to abuse.
The highest-risk problems rise to the top, with clear instructions your coding tool can follow.
WHAT IT CHECKS
Anything that looks like a key, token, or password committed to your repo — including the AI tool keys your coding agent uses.
Where your database lets the wrong people in, or lets signed-in users see each other’s data.
The places a determined user could downgrade a plan, replay a webhook, or call a paid endpoint without paying.
The omissions that turn a stolen cookie or a leaked reset link into a full account takeover.
THE ARTIFACT
A redacted report captured from the real output shape. The same cards, severities, and location format the customer sees after their own scan.
PRICING
A useful first security snapshot.
The deep one — every produced finding unlocked.
The Full scan, run weekly, with change tracking.
Every pricing option runs the same scan. Free gives you three priority findings explained; Full unlocks everything; Monthly runs Full weekly. Run a free scan.
THE REALITY
A user profile table was reachable without authentication; the published Supabase key was meant for client use, but the table behind it had no row-level security.
What Ephyra could have flagged if the relevant configuration was present in the repo: a `CREATE TABLE` without a matching `ENABLE ROW LEVEL SECURITY` in any migration.
GitHub inadvertently pushed a production RSA SSH host key (used to authenticate `git@github.com` over SSH) into a public repository on the platform. The exposure lasted long enough that GitHub rotated the host key globally and asked every user to update their `known_hosts`. The mistake was caught by a third-party security researcher who flagged the key.
What Ephyra could have flagged if the relevant configuration was present in the repo: a bare RSA private key block in any tracked file matched against the secrets category.
Each began with a security control that code review or configuration review could have caught before launch.
WHERE THE CHECKS COME FROM
Ephyra’s checks are shaped by assigned CVEs, published security research, and failures found in real AI-built apps. This is not a generic “look for bugs” pass. It is a focused security scan built around the mistakes that keep reaching production.
Broken Object Level Authorization in Lovable-generated apps left database rows readable and writable across tenants. A documented, assigned CVE, not a hypothetical.
The 2025 GenAI Code Security Report found 45% of AI-generated code introduced security vulnerabilities mapped to the OWASP Top 10.
GOOD TO KNOW
You can — and you should apply the fixes in your coding tool — but the hard part of security work is knowing what to ask it to fix. A general prompt like 'find the security problems' returns a vague list of best practices, not a precise, ranked fix list anchored to your repo. Ephyra gives your tool the specific inputs it needs: where the issue is, why it matters, and what needs to change.
No — Ephyra diagnoses. You take the prioritized fix list to your coding tool and apply the changes there. The hard part of security work is knowing what to ask your tool to fix; Ephyra gives you that precise list — where the issue is, why it matters, and what needs to change.
Ephyra is the fastest first security layer. It catches the common documented flaws quickly and cheaply. A broader engineering review adds value on architecture and unusual business-logic questions when you need it. Ephyra is not less reliable; it answers different questions.
No — Ephyra reads your repository during the scan, then deletes the working copy. Your report stays available to you.
Most scans finish in a few minutes. Larger repositories can take longer.
GitHub repositories. We connect with read-only access — we cannot modify your code.