v0.6.0

New: UnnecessaryInterpolatingSigil check

A new readability check flags lowercase sigils (~s, ~c, ~w, ~r) that contain no #{} interpolation and can be replaced with their uppercase counterparts (~S, ~C, ~W, ~R). This makes intent explicit—the content is static and will never contain dynamic expressions. Particularly useful alongside the XSS check: raw(~S"") is immediately recognizable as safe compile-time HTML.

Improved: [CWE-200] SensitiveDataExposure (fewer false positives)

The check previously flagged static Logger messages like “Unknown message type in queue, skipping” because “skipping” contains the substring “pin” (a sensitive term). The check now:

• Skips plain binary string arguments entirely (static text cannot leak runtime secrets)
• Only inspects keyword list values, not keys (metadata labels are not sensitive data)
• Only checks dynamic parts of interpolated strings, ignoring static text fragments
• Correctly recurses into function call arguments (e.g. Kernel.to_string(token) in interpolation)

Improved: [CWE-79] XSSVulnerability

Now detects Phoenix.HTML.raw/1 in addition to bare raw/1. String literals and non-interpolating sigils (~S) are recognized as safe and no longer flagged.

Improved: [CWE-502] UnsafeDeserialization

Piped calls like data |> Base.decode64!() |> :erlang.binary_to_term([:safe]) are now correctly recognized as safe.

Improved: UnmanagedTask

Task.start_link/1 was removed from the flagged functions—it is a valid supervised pattern. The check now only flags Task.async/1 and Task.start/1.

Enjoy!

Thank you for the library @mudasobwa. I have found it very useful. Already installed it in a project of mine and found a handful of issues.

I ended up changing the default configs in .credo.exs for:

  {OeditusCredo.Check.Security.PathTraversal, files: %{excluded: ["test/**/*.exs"]}},

User input is not an issue in tests dealing with paths. Maybe for this cause it could be useful to have the :exclude_test_files param.

Also when compiling the project it generated a few warnings under

• elixir 1.20.0-rc.3-otp-28
• erlang 28.1.1

Everything else is fixed in v0.3.1. Enjoy!