Packages
mob_dev
0.5.16
0.6.23
0.6.22
0.6.21
0.6.20
0.6.19
0.6.18
0.6.17
0.6.16
0.6.15
0.6.14
0.6.13
0.6.12
0.6.11
0.6.10
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.17
0.5.16
0.5.15
0.5.14
0.5.13
0.5.12
0.5.11
0.5.10
0.5.9
0.5.8
0.5.7
0.5.6
0.5.5
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.0
0.3.37
0.3.35
0.3.34
0.3.33
0.3.28
0.3.26
0.3.23
0.3.21
0.3.19
0.3.18
0.3.17
0.3.16
0.3.15
0.3.14
0.3.13
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.18
0.2.17
0.2.15
0.2.14
0.2.13
0.2.12
0.2.11
0.2.10
0.2.9
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
0.2.2
0.2.1
0.2.0
0.1.0
Development tooling for the Mob mobile framework
Current section
Files
Jump to
Current section
Files
lib/mob_dev/security_scan.ex
defmodule MobDev.SecurityScan do
@moduledoc """
Top-level API for `mix mob.security_scan`.
Runs every layer of the scan against the current project and
returns a `Report`. Layers cover:
* Hex dependency CVEs (`mix_audit` + OSV)
* Android Gradle dependency CVEs (`osv-scanner`)
* iOS Swift Package dependency CVEs (`osv-scanner`)
* Bundled-runtime CVEs — OpenSSL/SQLite/OTP/Elixir baked into
the OTP tarballs (manifest + fingerprint verification +
OpenSSL/SQLite/Erlef advisory feeds)
* C source static analysis (semgrep, flawfinder)
* Kotlin static analysis (detekt)
* Swift static analysis (`xcodebuild analyze`)
Each layer can be disabled with `--skip <name>`. Layers
never raise: a missing tool or unreadable file lands as a
`LayerResult` with status `:tool_missing` or `:error`, not
an exception.
"""
alias MobDev.SecurityScan.{Report, Runner}
@default_layers [
MobDev.SecurityScan.Layers.HexDeps,
MobDev.SecurityScan.Layers.GradleDeps,
MobDev.SecurityScan.Layers.SwiftDeps,
MobDev.SecurityScan.Layers.BundledRuntime,
MobDev.SecurityScan.Layers.CSource,
MobDev.SecurityScan.Layers.KotlinSource,
MobDev.SecurityScan.Layers.SwiftSource
]
@doc """
Run the scan. `opts` may include:
* `:layers` — module list, defaults to `default_layers/0`
* `:skip` — list of layer-name atoms to skip
* `:project_root` — directory to scan; defaults to `File.cwd!/0`
* `:on_layer_start` / `:on_layer_done` — progress callbacks
"""
@spec run(keyword()) :: Report.t()
def run(opts \\ []) do
layers = Keyword.get(opts, :layers, default_layers())
Runner.run(layers, opts)
end
@doc "Default layer list. New layers register here as they are built."
@spec default_layers() :: [module()]
def default_layers, do: @default_layers
end