Security Essentials

RULES — Follow these with no exceptions

1. Never use String.to_atom/1 on user input — atoms are never garbage collected; user-controlled atoms exhaust the atom table and crash the BEAM VM
2. Never interpolate strings into fragment() or SQL.query() — always use ? parameters for fragments and $1 for raw SQL
3. Never redirect to user-controlled URLs — validate against a whitelist or use verified routes (~p"...")
4. Avoid raw/1 in templates — Phoenix auto-escapes for a reason; if HTML is required, sanitize first with a library like HtmlSanitizeEx
5. Never log sensitive data — passwords, tokens, secrets, API keys, and credentials must never appear in Logger calls
6. Use Plug.Crypto.secure_compare/2 for token comparison — never ==, which enables timing attacks
7. Run dependency audits after changes — mix deps.audit, mix hex.audit, and mix sobelow catch known vulnerabilities

Atom Table Exhaustion

The BEAM atom table has a fixed limit (default ~1M atoms) and is never garbage collected. If an attacker can create arbitrary atoms, they crash the entire VM.

Bad: