Sobelow is a security-focused static analysis tool for the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of points-of-interest. For project maintainers, it can be used to prevent introducing a number of common vulnerabilities.
Currently Sobelow detects some types of the following security issues:
- Insecure configuration
- Cross-Site Scripting
- SQL injection
- Directory traversal
- Unsafe serialization
Potential vulnerabilities are flagged in different colors according to confidence in their insecurity. High confidence is red, medium confidence is yellow, and low confidence is green.
There was some initial discussion, but I thought it could use its own thread. This is just the initial release, so additional features will be added over time, and I'm sure things will change and update based on feedback. Feel free to ask any questions here, or message me on the Elixir slack channel or Keybase chat. I'm @griffinmb on both!
You can find the repository here, and a video demo here!