Show notes
Peter Ullrich returns to talk about a CVE hunt across the most-downloaded Hex packages, run with Claude Code on Opus 4.7. After ElixirConf EU pulled him into AI security, he started pointing Opus at popular libraries day and night, and within half an hour of his first serious attempt he found the Decimal vulnerability, where raising 10 to a huge power can blow up an application's memory.
We get into what separates a real CVE from noise, how CVSS scoring works, and why reachability matters so much, since a flaw in Phoenix's default config matters far more than a crash in a function nobody can…
Website: podcasters.spotify.com