Security - Joser's Elixir

Same Code, Three Runs: What --rci 2 Did to the Findings

May 13, 2026 security tools 9 min read

A plugin update for stride-security-review shipped today, so I ran it against Trays Social without changing a line of application code. Then I ran it again. Same plugin version, same files, different counts and, more importantly, different reads on whether there was a Critical at all.

Run 1 (single-pass): 44 findings, 0 Critical, 2 High.
Run 2 (single-pass): 40 findings, 1 Critical, 2 High.
Run 3 (--rci 2): 33 findings, 1 Critical, 3 High.

--rci 2 adds two extra critique passes (the flag is clamped to a max of 3). After that the picture settled.

Running the Stride Security Review Plugin on Trays Social

May 12, 2026 security tools 3 min read

I pointed the stride-security-review Claude Code plugin at Trays Social and let it walk the whole repo. 289 files across the Phoenix backend, the iOS client, the Dockerfile, the Fly workflow, and Ecto migrations. It batched the scan into 29 chunks and merged the results.

Basic Security Measures with Sobelow and Mix Audit

October 3, 2025 Elixir Security 2 min read

Security First

Security should be a priority from the start of any project. In the Elixir ecosystem, we have excellent tools to help catch security vulnerabilities early in development. Two essential tools are Sobelow for static security analysis and Mix Audit for dependency vulnerability checking.