Security Essentials

RULES — Follow these with no exceptions

1. Never use String.to_atom/1 on user input — atoms are never garbage collected; user-controlled atoms exhaust the atom table and crash the BEAM VM. String.to_existing_atom/1 avoids that risk but still raises ArgumentError on unknown input (unhandled 500) — whitelist with a case instead of either
2. Never interpolate strings into fragment() or SQL.query() — always use ? parameters for fragments and $1 for raw SQL
3. Never redirect to user-controlled URLs — validate against a whitelist or use verified routes (~p"...")
4. Avoid raw/1 in templates — Phoenix auto-escapes for a reason; if HTML is required, sanitize first with a library like HtmlSanitizeEx
5. Never log sensitive data — passwords, tokens, secrets, API keys, and credentials must never appear in Logger calls
6. Use Plug.Crypto.secure_compare/2 for token comparison — never ==, which enables timing attacks
7. Run dependency audits after changes — mix hex.audit checks for retired/deprecated packages (checksum verification against Hex is already automatic via mix.lock); mix deps.audit (requires adding {:mix_audit, "~> 2.1", only: [:dev, :test], runtime: false}) checks for known CVEs; mix sobelow does static security analysis of your code

Atom Table Exhaustion

The BEAM atom table has a fixed limit (default ~1M atoms) and is never garbage collected. If an attacker can create arbitrary atoms, they crash the entire VM.