Description

This detector identifies Elixir Ecto models that store passwords in plaintext fields without proper hashing or encryption. Storing passwords in plaintext is a critical security vulnerability that exposes user credentials if the database is compromised, violating security best practices and compliance requirements.

Detection Strategy

• Scans Elixir source code for Ecto model definitions and schema fields

• Identifies database field declarations that appear to store password data

• Checks if password fields lack proper hashing mechanisms or encryption

• Reports vulnerability when password-related fields are configured for plaintext storage in the database schema

Vulnerable code example

defmodule UserRegistration do
  import Ecto.Changeset
  alias MyApp.Repo
  alias MyApp.User

  def register_user(conn) do
    password = conn.params["password"]
    ...

✅ Secure code example

defmodule UserRegistration do
  import Ecto.Changeset
  alias MyApp.Repo
  alias MyApp.User

  def register_user(conn) do
    password = conn.params["password"]
    ...