I see it working like npm’s vulnerability report feature [1]. We have a form on hex.pm where vulnerabilities can be reported, when a new report is submitted it will be reviewed and if it is determined that there may be a security issue we will notify the package owners. The report will be disclosed publicly after a fix has been released or after certain of days regardless if there is a fix.

It can be integrated with mix hex.audit and package versions with publicly disclosed vulnerabilities should have it visible on their package page.

The reviewers would be a group of volunteers that are trusted in the community and have a track record of working on security issues.

Implementation wise for Hex it is not a lot of work, the bigger problem is putting together and organizing the group reviewers.

To keep the scope small I suggest we focus on the vulnerability reporting instead of including other features such as GitHub integration.

[1] https://www.npmjs.com/advisories/report

If this idea ends up picking up traction and you do look for a team of reviewers, I’m happy to help out with defining that process and jumping onboard.

I’ve been working in security professionally for a long time, and coding Elixir professionally for a few years, and I wouldn’t mind something like this coming to the Elixir ecosystem.

whether there are any unfixed vulnerabilities

GitHub stars are a really bad metric for that. Package Versions with a vulnerability should be retired to show that they are not secure.

Then it’s imho still better to run the patched version besides the fact that I cannot see a way to relyably detect where someone is deploying to.

Sounds like a good idea

Slightly related, there was some talk about expanding Hex.pm a couple of years ago - the thread contains some ideas about incorporating GH stars and other ideas to gauge popularity etc.

Perhaps some of those ideas could be considered at the same time?