Dangerous operations reachable from request-shaped input.
Argus.Analyses.AtomSafety gates the same sinks on "reachable from some
exported function", which in a library is very nearly everything — it
answers "is this code live", not "can an attacker reach it". This analysis
asks the sharper question by starting from OTP callbacks that receive
external data: Plug.call/2, LiveView mount/handle_params/
handle_event, Phoenix.Channel.handle_in/3, Oban.Worker.perform/1,
and Broadway's message callbacks.
That distinction is the difference between a smell and an incident. A
String.to_atom in a config loader is a smell. The same call reachable
from handle_event/3 is a remotely triggerable node kill: the BEAM atom
table is fixed-size (default 1,048,576) and never garbage collected, so an
attacker who can send distinct strings permanently consumes slots until
the VM aborts — taking every process on the node with it, with no
recovery short of a restart.
Known imprecision
Reachability is context-insensitive and function-granular, inherited from
call_reachable. A path through a generic dispatcher — anything that
fans out to many callees — can therefore be spurious. Findings name the
reaching entry point precisely so that path can be checked by hand, and
severity is assigned on the assumption that it will be.