Security Working Group Minutes

Erlang Ecosystem Foundation EEF Security
43

September 16, 2026

Participants: @kiko, @Alistair, @halostatue, @maennchen, Chris Hildebrand, Peter Ullrich, George Madi, @georgeguimaraes, Paul Swartz, Dan Janowski, @voltone

Updates from the CNA

  • New CNA software:
    • Makes job of managing CVEs easier
    • Lot of active use (1k req/hour), bots but also users looking up CVEs
    • Has already helped expedite OTP CVEs
    • Selective delegation to core teams (Ash)
    • Working on improving GHSA integrations
  • Stats (https://cna.erlef.org/):
    • 179 so far this quarter
    • Still rate-limiting findings from Peter, to not overload the process
    • New models find a bit more, but not a lot
      • Focussing on scanning more packages, not rescanning previous ones with a new model
    • Maybe in a year we’ll get to a state where we don’t produce more than we can process
    • Nice view: findings by CWE
  • Hex integration
    • Button to report vulnerability
    • Invite using hex handle (looks up email)
  • SID (Software ID) purl for things that are not in package repo
  • Compared to other CNAs (CNA Analysis - CVE.ICU):
    • EEF was #24 (of 376) over the last year

Syscalls to avoid path traversal vulnerabilities

  • Expose syscalls openat etc.
    • Needs to be in OTP

Community outreach

  • Some conferences coming up
    • Opportunity to record videos
  • Peter working on a blog post on Ash

hex.pm

  • Some work in progress:
    • SSO for orgs
    • Trusted publishing

Silica update

Next meeting

Wed 14 October 2026 at 16:00 CEST / 14:00 GMT / 10am EDT / 7am PDT / 23:00 JST

1 Like