Finding vulnerabilities is getting cheaper. Fixing them is not. On 8 October, @AnthropicAI opened OSS Scanner: free, periodic scans for eligible open-source projects. Reports are model-generated and not reviewed by a person before they reach maintainers. Each comes with a reproducer and, where possible, a candidate patch. Anthropic says its models flagged over 29,000 candidate vulnerabilities in six months, and that in an expert check 85 of 97 critical and high-severity findings (88%) met its disclosure bar. A day later, the BEAM There, Done That podcast asked Ingela Andin, who has maintained the TLS stack in Erlang/OTP for over 20 years, what happens on the receiving end. AI agents help narrow down and summarize a report; a person verifies it. Fixes are patched across three supported OTP releases at once, and CVE and SBOM records are published through the EEF's CNA on release day. For teams running Elixir in production, the work moves downstream: → Stay on a supported OTP release, so security fixes reach you as an upgrade, not a migration. → Contribute local OTP patches upstream. A private patch has to be carried forward on every upgrade, which slows down each security update. → Put security checks in CI: Sobelow for your own code, and a dependency scan for mix.lock (for example Google's OSV-Scanner GitHub Action). In our State of Elixir 2025 survey, 69.6% of respondents used Credo, but only 29.5% used Sobelow. → If you maintain a library, publish a security policy and enable private vulnerability reporting. How long does it take your team to ship an OTP or dependency security update today? #elixir #erlangotp #appsec #elixirlang

Curiosum has been recognized by the Elixir core team as an Elixir Open Source Steward. It reflects our work on Hologram, Permit, Kanta, and other Elixir community initiatives. We’ll keep contributing where we can. #elixirlang #opensource #softwaredevelopment #elixircommunity #elixirprogramming #myelixirstatus