Don’t let it crash: How we applied our security checks on Elixir code
summary
Team adapts the Erlang static analyzer Refactor and the security layer SAFE to Elixir by analyzing BEAM abstract code, building a semantic program graph, and running taint and data‑flow filters. Static checks uncover over 500 Erlang and more than 300 Elixir vulnerabilities, including an exploited DoS against RabbitMQ via atom exhaustion, plus unsafe command execution and dynamic code loading. Results map back only to source lines (no precise columns), and Elixir-specific checkers and Phoenix app knowledge are added to reduce false positives.
AI-written summary · about
chapters (7)
- 0:00Security analysis in Elixir
- 3:58False positives in static analysis
- 7:34Elixir vulnerabilities cases
- 12:37Adapting static analysis
- 19:38Semantic filtering for detection
- 26:05Findings and future directions
- 27:09Q&A
related talks
18mSecuring Erlang and Elixir applications
21mWhat Are the Critical Security Flaws in My System?
37mSecurity of the BEAM
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
23mThanks for all the bugs!
36mUsing Ruby In Security Critical Applications
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
23mStopping vulnerabilities at the source