Chat & Discussions>Discussions

Sobelow - Uncover vulnerabilities in your Phoenix projects

/phoenix#security
griffinbyatt

griffinbyatt

Sobelow

Sobelow is a security-focused static analysis tool for the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of points-of-interest. For project maintainers, it can be used to prevent introducing a number of common vulnerabilities.

Currently Sobelow detects some types of the following security issues:

  • Insecure configuration
  • Cross-Site Scripting
  • SQL injection
  • Directory traversal
  • Unsafe serialization

Potential vulnerabilities are flagged in different colors according to confidence in their insecurity. High confidence is red, medium confidence is yellow, and low confidence is green.

There was some initial discussion, but I thought it could use its own thread. This is just the initial release, so additional features will be added over time, and I’m sure things will change and update based on feedback. Feel free to ask any questions here, or message me on the Elixir slack channel or Keybase chat. I’m @griffinmb on both!

You can find the repository here, and a video demo here!

65 comments
/phoenix#security
13488 65

Showing Posts 1 to 10

griffinbyatt

griffinbyatt OP

If sobelow helps you find and fix a vulnerability, let me know! I’d love to hear where it helps out. Additional feedback, feature suggestions, etc are also greatly appreciated :slight_smile:

4
Post #1
griffinbyatt

griffinbyatt OP

Pushed a couple small updates, including checks for some command injection vectors! Upcoming updates will focus on simplifying and streamlining the codebase and expanding checks that are already in place (e.g. additional SQL and XSS checks).

2
Post #2
hassan

hassan

Just updated but –

10:17 ~/testcases/elixir/ncrud/nada(upgrade)[ruby-2.3.3@global]$ mix
archive.install
https://github.com/nccgroup/sobelow/raw/master/sobelow.ez
Found existing archive: /Users/hassan/.mix/archives/sobelow.
Are you sure you want to replace it with
"https://github.com/nccgroup/sobelow/raw/master/sobelow.ez"? [Yn] Y
* creating /Users/hassan/.mix/archives/sobelow
10:18 ~/testcases/elixir/ncrud/nada(upgrade)[ruby-2.3.3@global]$ mix sobelow
0
Post #3
griffinbyatt

griffinbyatt OP

For the time being, every update will end up going through the “replace existing archive” dialogue. In the future, I may implement some sobelow-specific upgrade functionality that allows that to be bypassed, but that will be closer to 1.0.

Let me know if I misunderstood your concern :slight_smile:

0
Post #4
hassan

hassan

Let me know if I misunderstood your concern

Apparently discourse mangled my post, so –

1
Post #5
griffinbyatt

griffinbyatt OP

That makes more sense ha.

It looks like there was an inadvertent space in the version number. If you try again, it should work. If not, I pushed an update to trim the version number so it should work no matter what. Let me know if that fixes your issue!

0
Post #6
hassan

hassan

It looks like there was an inadvertent space in the version number. If you try again, it should work.

It was a consistent failure.

If not, I pushed an update to trim the version number so it should work no matter what. Let me know if that fixes your issue!

Yep, installed the latest and it works now – thanks for the prompt
response and the cool tool :grinning_face:

0
Post #7
griffinbyatt

griffinbyatt OP

Excellent! Glad that solved the problem. Thanks for the detailed bug report :smile:

0
Post #8
cbarratt

cbarratt

This tool looks great! I’ll definitely be running it through my projects.

1
Post #9
griffinbyatt

griffinbyatt OP

Thanks, let me know if it helps you find and fix anything! :smiley:

0
Post #10

Where Next? Top

View thread on forum (has 65 replies!)
phoenix
security
Home Chat & Discussions>Discussions
109 13161 65
Last post
REPLY VIEW THREAD WITH 65 POSTS

Trending in Discussions Top

AstonJ
Chat & Discussions>Discussions

What Elixir related stuff are you doing?
As the title says, please share what you’ve been up to with Elixir. Whether that’s been learning it, looking into it, making stuff with i...
#community
2977 94592 917
New
cblavier
Chat & Discussions>Discussions

Phoenix Storybook: a storybook-like UI interface for Phoenix components
Hey there, It’s been more than a year since we started using LiveView as our main UI library and building a whole library of UI componen...
/phoenix#liveview#storybook
511 11537 94
New
mudasobwa
Chat & Discussions>Discussions

Cure - a new language compiled to BEAM
I am happy to introduce the very α version of the new programming language compiled to BEAM. Welcome Cure. It has literally three kille...
#static-types#type-checking#types#fsm
171 6315 70
New
heathen
Chat & Discussions>Discussions

Ergo - a framework for creating microservices using technologies and design patterns of Erlang/OTP in Golang
Quite interesting article Google brought me. Didn’t find any mentions about it here. What do you think in general? Would you use togethe...
#otp#go#golang
44 4812 14
New
mhanberg
Chat & Discussions>Discussions

Expert LSP is now available!
Hi everyone! The first release candidate for the Expert language server project is now available! We’ve published a press release detai...
#lsp#expert
220 4348 38
New
axelson
Chat & Discussions>Discussions

Remote Elixir Book Club (takes place on Discord)
Hi there! :wave: @frigidcode and I (but mostly him) have been running an Elixir Book club, we’re almost done with Designing Elixir Syste...
#meetups#book-club
43 3071 23
New
budgie
Chat & Discussions>Discussions

I genuinely hate programming now
A little off-topic, but I feel like people here have a good head on their shoulders. I used to be quite good at making software. Was luc...
#ai#career#rant
188 1103 47
New

Other Trending Topics Top

GenericJam
News>Announcing

Mob - Native BEAM / Elixir on Native Mobile
Edit: 2026 May 15 - This post is archived. Mob is alive!! Main docs: mob v0.7.11 — Documentation A bit of explanation for the slightly c...
/mob#library#beam#mobile#liveview#react-native#mobile-app#mobile-development
256 7926 107
New
JesseHerrick
News>Announcing

Dexter - A fast, full-featured Elixir LSP optimized for large codebases
Hey, I’m Jesse and I’m the main contributor behind Dexter, a full-featured, lightning-fast Elixir LSP optimized for large codebases. It s...
#library#lsp#dexter
187 6988 64
New
marciok
News>Announcing

Gust - A task orchestration system built in Elixir
Hi there! We created Gust: A task orchestrator inspired by Airflow. For those who have never heard about Aiflow, it’s a Python-based wor...
/phoenix/oban#library#workflow#background_job#reactor
111 4469 40
New
jimsynz
News>Announcing

Beam Bots - Resilient Robotics on the BEAM
Beam Bots (or just BB for short) is a framework for building fault-tolerant robotics applications in Elixir using familiar OTP patterns. ...
/beam-bots#library#robotics#bb
119 2916 28
New
georgeguimaraes
News>Announcing

Claude Code Elixir - Claude Code plugin marketplace for Elixir development
Just published claude-code-elixir, a plugin marketplace for Claude Code with Elixir support. These are the plugins I’ve been using for my...
#library#claude-code#marketplace
23 2253 9
New
Dmk
News>Announcing

Xamal - Deploy Elixir releases to bare metal servers via SSH
Xamal is a deployment tool for Elixir apps that deploys native releases to bare metal servers over SSH. It’s a port of GitHub - basecamp/...
#library#deployment#deploy#deployments#xamal
75 2512 33
New
Back to top

Latest Phoenix Threads

Phoenix Forum ❯

Chat & Discussions>Discussions

Chat Discussions ❯

Latest on Elixir Forum

Elixir Forum ❯

Sponsor Spotlight

Code Sync

Elixir, Erlang & messaging conferences from Code Sync. Next up: ElixirConf US (10–11 Sep) & Code BEAM Europe (21–22 Oct), Haarlem + online.

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Honeybadger

Error tracking, logs, uptime, and Just Enough APM. Built for developers.

Code Sync

Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!

Manning

Master modern tools, write cleaner code, and tackle real-world challenges.

ElixirCasts

Producing high quality Elixir screencasts since 2017.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Software Mansion

The team behind Membrane, Popcorn, LiveDebugger. Available for hire.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

Categories:

Sub Categories:

Forums

Popular Tags

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Honeybadger

Error tracking, logs, uptime, and Just Enough APM. Built for developers.

Code Sync

Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!

Manning

Master modern tools, write cleaner code, and tackle real-world challenges.

ElixirCasts

Producing high quality Elixir screencasts since 2017.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Software Mansion

The team behind Membrane, Popcorn, LiveDebugger. Available for hire.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

We're in Beta

About us Mission Statement

Options

Thread Display Mode




Thread Preview

Skip Thread Previews