# Security Working Group Minutes

**URL:** <https://erlangforums.com/t/security-working-group-minutes/3451>\
**Category:** EEF Security\
**Tags:** minutes\
**Created:** [April 4, 2024, 1:36pm UTC](https://erlangforums.com/t/security-working-group-minutes/3451 "2024-04-04T13:36:55Z")\
**Posts on this page:** 2\
**Page:** 3

<div class="post-metadata">

**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\
**Post date:** [September 18, 2026, 7:37am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/43 "2026-09-18T07:37:57Z")

</div>

# September 16, 2026

Participants: @kiko, @Alistair, @halostatue, @maennchen, Chris Hildebrand, Peter Ullrich, George Madi, @georgeguimaraes, Paul Swartz, Dan Janowski, @voltone

## Updates from the CNA

- New CNA software:
  - Makes job of managing CVEs easier
  - Lot of active use (1k req/hour), bots but also users looking up CVEs
  - Has already helped expedite OTP CVEs
  - Selective delegation to core teams (Ash)
  - Working on improving GHSA integrations

- Stats ([https://cna.erlef.org/](https://cna.erlef.org/)):
  - 179 so far this quarter
  - Still rate-limiting findings from Peter, to not overload the process
  - New models find a bit more, but not a lot
    - Focussing on scanning more packages, not rescanning previous ones with a new model

  - Maybe in a year we’ll get to a state where we don’t produce more than we can process
  - Nice view: [findings by CWE](https://cna.erlef.org/common-weaknesses/1000)

- Hex integration
  - Button to report vulnerability
  - Invite using hex handle (looks up email)

- SID (Software ID) purl for things that are not in package repo
- Compared to other CNAs ([CNA Analysis - CVE.ICU](https://cve.icu/cna.html)):
  - EEF was #24 (of 376) over the last year

## Syscalls to avoid path traversal vulnerabilities

- Expose syscalls `openat` etc.
  - Needs to be in OTP

## Community outreach

- Some conferences coming up
  - Opportunity to record videos

- Peter working on a blog post on Ash

## hex.pm

- Some work in progress:
  - SSO for orgs
  - Trusted publishing

## Silica update

- Breaking [news](https://erlangforums.com/t/slica-has-reached-fixed-point/5947) from @LeeB

## Next meeting

Wed 14 October 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST

---

<div class="post-metadata">

**Author:** ![voltone](https://erlangforums.com/user_avatar/erlangforums.com/voltone/32/272_2.png) [@voltone](https://erlangforums.com/u/voltone)\
**Post date:** [October 15, 2026, 6:48am UTC](https://erlangforums.com/t/security-working-group-minutes/3451/44 "2026-10-15T06:48:47Z")

</div>

# October 14, 2026

Participants: Dan Janowski, @maennchen, @Alistair, @voltone, @halostatue, @varnerac, George Madi, @georgeguimaraes, @kiko, Marc Nickert

## Q3 Report

- CNA:
  - 208 CVEs processed (up from 87 in Q2)
  - Improved process and tools made this possible
  - Helped by additional participants (Eric, Peter)
  - Working on improving GHSA integration

- Hex:
  - Secret scanning
  - Progress on workload identity and trusted publishing (by @alchemist_ubi)

- Several articles published; listed here:
  - [CNA for the Erlang Ecosystem | EEF Community](https://com.erlef.org/wg/cna)
  - [Security Working Group | EEF Community](https://com.erlef.org/wg/sec)

## Update on tooling and agents

- Tools:
  - SARIF reporting coming soon to Hex
  - Dependabot issues:
    - Open PRs with little progress for Elixir & co
    - Internal vuln DB rather than OSV; lagging behind

  - Argus [GitHub - QuinnWilton/argus · GitHub](https://github.com/QuinnWilton/argus)
    - Datalog queries to find issues
    - Goatmire Elixir talk

- AI:
  - Joined Anthropic cyber verification, using Mythos (defensive)

## Linux Foundation Open Source Summit (Prague)

- Jonatan and Alistair attended
- CRA interest picking up
- Alpha&Omega event:
  - About 20 language communitie
  - Some are struggling; we’re coping well, thanks to our CNA

## “Bernies”

- Unmaintained projects
- Alpha&Omega are wondering how ecosystems deal with this
  - For us, being discussed in Libraries & Frameworks
  - Need to involve Hex team

## Any other business

- New file APIs (see last month):
  - PoC by Jonatan
  - Need OTP team feedback (code is [here](https://github.com/maennchen/otp/tree/jm/kernel/openat-v2))

## Next meeting

Wed 11 November 2026 at 16:00 CET / 15:00 GMT / 10am EST / 7am PST / 0:00 JST (so effectively Thu)

**Beware of DST switch** ; nothing changes if your timezone switches from DST to standard time in the next four weeks

Also note that next month’s meeting will use a **different Zoom link** ; it will be shared in Slack one hour before the meeting starts, as usual

[Previous page](https://erlangforums.com/t/security-working-group-minutes/3451.md?page=2)