SAFE (Security Analysis for Erlang/Elixir) is a static analysis tool from Erlang Solutions that targets compiled BEAM files to detect application-level vulnerabilities like XSS, SQL injection, atom exhaustion, and session management flaws. Its key differentiator is data-flow analysis, which tracks possible variable values through the program to eliminate false positives — achieving a 7.78% false positive rate across ~70,000 lines of tested open source code. Unlike pattern-matching tools that flag every dangerous function call, SAFE can determine when guarded atom creation or compile-time metaprogramming makes a call safe. It covers Erlang, Elixir, and Phoenix codebases uniformly. The tool is free for open source projects and commercial for others.
