existential-birds Elixir Security Review
Quick Reference
| Issue Type | Reference |
|---|---|
| Code.eval_string, binary_to_term | references/code-injection.md |
| String.to_atom dangers | references/atom-exhaustion.md |
| Config, environment variables | references/secrets.md |
| ETS visibility, process dictionary | references/process-exposure.md |
Review Checklist
Critical (Block Merge)
- No
Code.eval_string/1on user input - No
:erlang.binary_to_term/1without:safeon untrusted data - No
String.to_atom/1on external input - No hardcoded secrets in source code
Major
- ETS tables use appropriate access controls
- No sensitive data in process dictionary
- No dynamic module creation from user input
- Path traversal prevented in file operations
Configuration
- Secrets loaded from environment
- No secrets in config/*.exs committed to git
- Runtime config used for deployment secrets
Valid Patterns (Do NOT Flag)
- String.to_atom on compile-time constants - Atoms created at compile time are safe
- Code.eval_string in dev/test - May be needed for tooling
- ETS :public tables - Valid when intentionally shared
- binary_to_term with :safe - Explicitly safe option used
Context-Sensitive Rules
| Issue | Flag ONLY IF |
|---|---|
| String.to_atom | Input comes from external source (user, API, file) |
| binary_to_term | Data comes from untrusted source |
| ETS :public | Contains sensitive data |
Hard gates (before reporting)
Complete in order for each finding you intend to report. Do not advance until the pass condition is satisfied.
- Location artifact — The finding includes
[FILE:LINE](or a line range) that you copied from the current file contents; the path resolves in this repo. - Scope read — You read the full surrounding function or module section that contains the flagged code, not only a diff hunk or summary.
- External-data claim (only if the finding depends on “user/untrusted input”) — You can name one concrete ingress (for example
conn.params,Jason.decode!/1result, uploaded file path, message from another node) or you drop the finding because the value is compile-time, test-only, or internal per Context-Sensitive Rules. - Protocol — Pre-report steps in review-verification-protocol are satisfied for this item (no finding if they are not).
Before Submitting Findings
Use the issue format: [FILE:LINE] ISSUE_TITLE for each finding.
Hard gate 4 requires review-verification-protocol; use it as the full pre-report checklist and issue-type verification (it extends beyond this skill’s summary).