Processes an outside party can create without limit.
DynamicSupervisor defaults to max_children: :infinity, and the default
is what everyone uses — eight DynamicSupervisors across the projects swept
for this, none of which set a cap. On its own that is fine: most dynamic
supervisors are driven by trusted callers.
The finding is the pairing, and it is a question about the call graph
rather than about any one line: can start_child be reached from a
request handler? If it can, an unauthenticated request creates a
process and nothing bounds how many. Each costs a PID, a mailbox and a
heap, and the node dies of memory exhaustion rather than of anything that
looks like an attack.
No single line is wrong, which is why reading the supervisor or the handler alone shows nothing.