Enforce Elixir/Phoenix security – auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets.
Enforce Elixir/Phoenix security - auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys.This is the skill's description: the text your AI reads to decide when the skill applies.
elixir-security/SKILL.md
---
name: security
description: "Enforce Elixir/Phoenix security — auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys."
effort: medium
user-invocable: false
paths:
- "**/*auth*.ex"
- "**/*session*.ex"
- "**/*password*.ex"
---
# Elixir/Phoenix Security Reference
> **Ash projects**: `AshAuthentication` has its own strategy/token patterns — use the `ash-framework` skill. CSRF, XSS, and secret management patterns below still apply.
Quick reference for security patterns in Elixir/Phoenix.
## Iron Laws — Never Violate These
1. **VALIDATE AT BOUNDARIES** — Never trust client input. All data through changesets
2. **NEVER INTERPOLATE USER INPUT** — Use Ecto's `^` operator, never string interpolation
3. **NO String.to_atom WITH USER INPUT** — Atom exhaustion DoS. Use `to_existing_atom/1`
4. **AUTHORIZE EVERYWHERE** — Check in contexts AND re-validate in LiveView events
5. **ESCAPE BY DEFAULT** — Never use `raw/1` with untrusted content
6. **SECRETS NEVER IN CODE** — All secrets in `runtime.exs` from env vars… load the full skill through Skill Me