Pharon

Pharon is a warning system for software teams that tracks your entire stack and alerts you when risks reach it. Key capabilities: • Inventory of every package, container image, GitHub Action, runtime and cloud service • Alerts within minutes for compromised releases and exploited vulnerabilities • Notices for vendor breaches and end-of-life deadline dates • Delivery through Slack, email and Claude Code, with secrets to rotate • Local scanning, so your code never leaves your machine Pharon works in three steps. First, it scans your repositories on your own machine and builds a complete list of the packages, images and cloud services you depend on. Second, it checks new compromised packages, exploited CVEs, vendor breaches and end-of-life dates against that inventory. Because matching happens against your actual dependencies, you only hear about incidents that touch systems you run, not the constant stream of advisories that do not apply to you. Third, when something matches, the team that owns the affected repository receives an alert with the context needed to respond, including which credentials to rotate. Sources include OSV.dev, GitHub Advisory, OpenSSF, CISA KEV, endoflife.date, PyPI, Go vulndb, RustSec, vendor bulletins and security news. Coverage updates run every five minutes for OSV.dev and security news, and daily for CISA KEV and end-of-life dates. A public notices page shows recent incidents, and the Claude Code plugin and CLI make it easy to query your inventory during development. Pharon is built for platform engineers, DevOps teams, security leads and small software companies that need to stay ahead of supply chain attacks without maintaining their own feed of advisories. It fits teams that want fast, targeted alerts, a clear view of their dependencies, and assurance that scanning stays private. The plan costs $49 per month and includes a 7-day trial.