nccgroup/sobelow

Sobelow is a static security analysis tool for Elixir and Phoenix applications that identifies vulnerabilities through a modular, pipeline-based scanning architecture. It detects a wide range of security issues, including SQL injection, cross-site scripting, remote code execution, command injection, and misconfigured headers. The system also scans for known vulnerabilities in third-party dependencies and insecure configuration patterns. Results are standardized into a structured finding format, supporting multiple output formats such as JSON and SARIF.

nccgroup/sobelow was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point the surveyor at a repository you know and see whether you agree with it.