existential-birds/beagle/elixir-security-review

Elixir Security Review

Quick Reference

Review Checklist

Critical (Block Merge)

• [ ] No Code.eval_string/1 on user input
• [ ] No :erlang.binary_to_term/1 without :safe on untrusted data
• [ ] No String.to_atom/1 on external input
• [ ] No hardcoded secrets in source code

Major

• [ ] ETS tables use appropriate access controls
• [ ] No sensitive data in process dictionary
• [ ] No dynamic module creation from user input
• [ ] Path traversal prevented in file operations

Configuration

• [ ] Secrets loaded from environment
• [ ] No secrets in config/*.exs committed to git
• [ ] Runtime config used for deployment secrets

Valid Patterns (Do NOT Flag)

• String.to_atom on compile-time constants - Atoms created at compile time are safe
• Code.eval_string in dev/test - May be needed for tooling
• ETS :public tables - Valid when intentionally shared
• binary_to_term with :safe - Explicitly safe option used

Context-Sensitive Rules

Hard gates (before reporting)

Complete in order for each finding you intend to report. Do not advance until the pass condition is satisfied.

1. Location artifact — The finding includes [FILE:LINE] (or a line range) that you copied from the current file contents; the path resolves in this repo.
2. Scope read — You read the full surrounding function or module section that contains the flagged code, not only a diff hunk or summary.
3. External-data claim (only if the finding depends on “user/untrusted input”) — You can name one concrete ingress (for example conn.params, Jason.decode!/1 result, uploaded file path, message from another node) or you drop the finding because the value is compile-time, test-only, or internal per Context-Sensitive Rules.
4. Protocol — Pre-report steps in review-verification-protocol are satisfied for this item (no finding if they are not).

Before Submitting Findings

Use the issue format: [FILE:LINE] ISSUE_TITLE for each finding.

Hard gate 4 requires review-verification-protocol; use it as the full pre-report checklist and issue-type verification (it extends beyond this skill’s summary).