nccgroup/sobelow

Health v2 · maintenance only

Adoption not part of the score

1791 stars · 126 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Sobelow is a security-focused static analysis tool for Elixir and the Phoenix framework, detecting common vulnerability classes like SQL injection, XSS, and command injection. It is distributed as a Mix dependency or escript and flags findings with confidence-based severity colors.

Use cases

• scan a Phoenix app for security vulnerabilities
• find SQL injection and XSS in Elixir code
• prevent introducing common vulnerabilities in CI
• audit insecure configuration and vulnerable dependencies
• get a quick points-of-interest view for security research

When to choose

• you maintain an Elixir/Phoenix web application and want automated security scanning
• you want SAST tuned specifically to Phoenix vulnerability patterns
• you need a lightweight CLI scanner installable via mix

When to avoid

• your project is not written in Elixir or does not use Phoenix
• you need dynamic testing, fuzzing, or runtime protection rather than static analysis
• you require broad multi-language SAST coverage

Facets

cli-tool · maturity active

security vulnerability-scanning linter testing security web-development developer-tools backend cli elixir cross-platform static-analysis sast phoenix-framework elixir code-scanning owasp

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nccgroup/sobelow")