🔗 Elixir and Phoenix Security Checklist: 11 Best Practices

Coding a web application in Elixir with the Phoenix framework gives you an incredibly solid base. Any security problems that occur are preventable, if you know what to watch out for. The list below is based on my own professional experience pentesting Elixir applications, and building a company to help developers with security. My goal is to help you avoid a data breach due to your project being hacked, each line item was selected with that consideration in mind.

The full list ranked in order of priority:

1. Maintain an inventory of all your public facing applications
2. Run static analysis scans with Sobelow regularly, in CI/CD if possible
3. Detect vulnerable dependencies with MixAudit (NOT Dependabot), in CI/CD if possible
4. Check the ports and SSH settings on your web server
5. Ensure your database server is not exposed to the public internet
6. Check for server side request forgery (SSRF), use the safeURL library if needed
7. Be wary of using ImageMagick, Ghostscript, and FFmpeg on user uploads
8. Rate limiting on authentication and payment endpoints
9. Scan your code base for secrets
10. Check for sequential IDs and access control violations
11. Check for mass assignment in Ecto