Elixir Security Review

Quick Reference

Review Checklist

Critical (Block Merge)

• - [ ] No Code.eval_string/1 on user input
• [ ] No :erlang.binary_to_term/1 without :safe on untrusted data
• [ ] No String.to_atom/1 on external input
• [ ] No hardcoded secrets in source code

Major

• - [ ] ETS tables use appropriate access controls
• [ ] No sensitive data in process dictionary
• [ ] No dynamic module creation from user input
• [ ] Path traversal prevented in file operations

Configuration

• - [ ] Secrets loaded from environment
• [ ] No secrets in config/*.exs committed to git
• [ ] Runtime config used for deployment secrets

Valid Patterns (Do NOT Flag)

• - String.toatom on compile-time constants - Atoms created at compile time are safe
• Code.evalstring in dev/test - May be needed for tooling
• ETS :public tables - Valid when intentionally shared
• binarytoterm with :safe - Explicitly safe option used

Context-Sensitive Rules

Before Submitting Findings

Use the issue format: [FILE:LINE] ISSUE_TITLE for each finding.

Load and follow review-verification-protocol before reporting any issue.