Most weeks there's a new one: a poisoned npm or PyPI release, an exploited CVE in a runtime, a vendor telling customers to rotate their keys. This week it was Railway: a breach exposed customers' environment variables, and $740,000 in fraudulent AI charges followed. Hearing about it is easy. The slow part is working out whether any of your repos use it, and what to rotate. So I built Pharon. **How it works** - A scanner runs on your machine (a Claude Code plugin around a small open-source CLI). It lists what each repo runs: packages from lockfiles, container images, GitHub Actions, runtimes, and optionally cloud resources through your own read-only AWS, GCP or Azure CLI. - Only names, versions and file paths are uploaded. No source code, no secret values, and nothing is sent until you approve it. - New incidents from OSV.dev, CISA's exploited-vulnerability list, endoflife.date and security news are matched against that inventory all day. When one hits, the team that owns the repo gets an email, a Slack message or a webhook, and a warning light comes on in Claude Code. - One command then checks the machine read-only and lists which secrets to rotate, by name only. **Where it is** Launched on Monday. The client is open source (Apache-2.0), the incident notices are public at getpharon.com/notices, and checking your machine against any of them is free, no account needed. Alerts start at $12/month for 10 projects, with a 7-day trial. **What I'd love feedback on** Would "only metadata leaves your machine" be enough for you to try it on a work repo, or would you need to self-host? The first scan needs Claude Code. Is that a deal-breaker? What would you want it to watch that it doesn't? https://getpharon.com   submitted by   /u/Additional_Curve3495 [link]   [comments]