Know the moment a security incident hits your stack
Pharon keeps an inventory of everything you run and alerts you within minutes when a compromised release, an exploited vulnerability, a vendor breach or an end-of-life date reaches it.
Incidents from the sources that publish them
- OSV.dev
- GitHub Advisory
- OpenSSF
- CISA KEV
- endoflife.date
- PyPI
- Go vulndb
- RustSec
- Vendor bulletins
- Security news
Install, link, done.
Install the plugin
Add Pharon to Claude Code. The command-line tool comes with it, so there is nothing else to install.
Link a repo
Run /pharon:setup. It logs you in, reads the stack on your machine and shows exactly what will be uploaded.
Pharon does the rest
Your inventory stays current, new compromises are picked up within minutes, and you're told the moment something you run is hit.
Whatever your stack, Pharon is watching it.
See what's covered- npm
- PyPI
- Go
- Rust
- Ruby
- PHP
- Java
- .NET
- Docker
- Actions
- Node
- Python
- AWS
- GCP
- Azure
- k8s
- Redis
- Postgres
Watch every layer with
zero blind spots
Incident alerts for npm packages, PyPI packages, container images, GitHub Actions, Node.js and Python runtimes, Postgres and Redis, Kubernetes, Lambda, Stripe, OpenAI, Vercel, Supabase
A local check for every notice
One command reads lockfiles, installed packages, caches and images on this machine, and gives a verdict for each place the component lives.
How checks workAlerts within minutes of a compromise
OSV.dev and security news are checked every 5 minutes, CISA KEV and end-of-life dates daily. Critical and high incidents go out right away, by email, Slack, webhook and in your next Claude Code session.
How alerts workSigned notices, data only
Every notice says what's affected, what to look for and what to do, signed with Ed25519. Nothing in a notice can run.
Browse noticesCloud services, read-only
Your own cloud CLI reads databases, clusters and functions, read-only. Pharon gets types and versions, with hashed ids.
Cloud docsTeam verdicts and a rotation checklist
Share a check's verdict with your team. The secrets it names become a checklist with owners, never values.
Read moreBuilt for the way
you already work
Pharon meets you in Claude Code, your inbox, Slack and your pull requests.
Session notices
Open Claude Code in an affected repo and Pharon speaks first, with the command to check.
Local check
Reads lockfiles, installed packages, caches and images on this machine, without changing anything.
Rotation checklist
Secret names from shared checks become a checklist with owners. Never their values.
Branch previews
Branches and uncommitted changes are checked without replacing the official inventory.
Pull request check
The GitHub Action fails a pull request that brings in a component with an open incident.
Slack and webhooks
Critical and high incidents go out at once. Webhook payloads are signed.
End-of-life dates
Runtimes and managed databases nearing end of support show up before the deadline.
Daily digest
Everything else arrives once a day, or not at all. Snooze any incident for a week.
Private and verifiable
by default
Know what leaves your machine, and trust what arrives.
Runs on your machine
The scan reads your stack where it lives. Source code and file contents never leave it.
Inventory only
Names, versions and paths of stack files. /pharon:show prints the exact upload.
Secret names, never values
A check names the secrets within reach so you know what to rotate. It never reads them.
Signed notices
Every notice carries an Ed25519 signature. The CLI rejects anything unsigned or altered.
Hashed cloud ids
Cloud accounts and resources are identified by hash unless you choose otherwise.
Your yes first
Pharon shows the first inventory and uploads nothing until you approve it.
Questions
Something else? Read the docs
What is Pharon?
Pharon is a warning system for software teams. It keeps an inventory of every package, container image, GitHub Action, runtime and cloud service you run, and alerts you within minutes when a compromised release, an exploited vulnerability, a vendor breach or an end-of-life deadline reaches it.
Does Pharon see my source code?
No. The scan runs on your machine and uploads only an inventory: component names, versions and the paths of stack files. Source code, file contents and secret values never leave your machine, and /pharon:show prints the exact upload.
Where do the incidents come from?
From OSV.dev (which includes the GitHub Advisory Database, PyPI, Go, RustSec and OpenSSF's malicious package reports), CISA's catalog of exploited vulnerabilities, endoflife.date, and security news and vendor bulletins summarized with Claude. Every notice is signed with Ed25519 and contains data only, never commands.
How quickly will I hear about a compromised package?
Pharon checks OSV.dev and security news every 5 minutes, and CISA KEV and end-of-life dates daily. When a notice affects something you run, critical and high alerts go out right away and the rest arrive in a daily digest, unless you choose otherwise.
How do I know whether a machine was actually affected?
Run /pharon:check-incident followed by the notice id in Claude Code. It looks at lockfiles, installed packages, package caches, Docker images and indicator files without changing anything, and lists the secrets to rotate by name.
Do I need Claude Code?
To connect a repo, yes: the Claude Code plugin sets it up and fills in what it can't see from files. After that, the GitHub Action keeps the inventory current from CI and checks pull requests, without anyone's laptop.
Does it replace my dependency scanner?
No. A dependency scanner keeps your packages patched. Pharon tells you when something you already run has been compromised, exploited or retired, across the whole stack, and whether you were exposed.