zingo
I’m learning Elixir and Phoenix now and really like it so far. However I started thinking of security.
What is the history of 0day-exploits for Phoenix (and Elixir) running on bandit or cowboy in production? Is it considered safe? Would it be a good/bad idea to introduce nginx as a reverse proxy? Any common pitfalls for a new developer where you can introduce weak points in your web-applications?
When searching on Google the only real thing I found was “:erlang.binary_to_term” which could be exploited. Is this something to worry about if you’re not using it explicitly in your code (but maybe the Phoenix framework uses it internally?).
I also found www.paraxial.io, which I guess is a paid service to find/prevent security issues in Elixir/Phoenix-applications. Maybe that could be a solution if you’re creating a commercial product, which I’m not doing at the moment.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #ai
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #elixirconf-eu
- #metaprogramming
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 3 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
realcorvus
None, the closest that we have ever seen to that was a RCE in the paginator library (not installed by default) - Remote Code Execution in paginator · CVE-2020-15150 · GitHub Advisory Database · GitHub
Yes! Elixir is (Still) Safe
It depends on your needs. From a security perspective you can do rate limiting at the Nginx layer or the Elixir app layer, I prefer in the Elixir app because it reduces complexity.
I’ve checked the Phoenix framework for this, they use the safe version. I’ve pentested several Elixir apps and have not found an instance of it “in the wild” yet, so not very common.
Use the free tier! You get a limited number of scans per month, if your project is non-commercial you’re good to stay on the free tier. (I am the founder of Paraxial.io)
LostKobrakai
The website of the EEF Security WG is also quite a good resource: EEF Security WG | Documentation, specifications and code from the Security Working Group of the Erlang Ecosystem Foundation
katafrakt
You may want to check Sobelow which is open source and I think Paraxial is using it as a base. This is only static code analysis, of course.