Description

This detector identifies hardcoded cryptographic keys in Elixir source code. When cryptographic keys are embedded directly in the source code as string literals or constants, they become visible to anyone with access to the codebase, creating a significant security risk as these keys cannot be easily rotated and may be exposed in version control systems.

Detection Strategy

• Scans Elixir source code for function calls that are known cryptographic sinks (functions that accept cryptographic keys as parameters)

• Identifies the key parameter in these cryptographic function calls

• Checks if the key argument is a hardcoded value (string literal, constant, or other static value) rather than being dynamically retrieved from environment variables, configuration files, or secure key management systems

• Reports a vulnerability when a cryptographic function is called with a hardcoded key parameter

Vulnerable code example

defmodule VulnerableExample do
  def encrypt_data(data) do
    # VULNERABLE: Hardcoded key in :crypto.crypto_one_time
    :crypto.crypto_one_time(:aes_256_ecb, "0123456789abcdef0123456789abcdef", data, true)
  end

  def mac_data(data) do
    # VULNERABLE: Hardcoded key in :crypto.mac...

✅ Secure code example

defmodule VulnerableExample do
  def encrypt_data(data) do
    # SAFE: Key from environment instead of hardcoded
    key = System.get_env("ENCRYPTION_KEY")
    :crypto.crypto_one_time(:aes_256_ecb, key, data, true)
  end

  def mac_data(data) do...