Jonatan Männchen

Bandit, fixed 11 CVSS-HIGH CVEs in 1.14.0. com.erlef.org/wg/sec/2026/... Hard work by Matt Trudel and the EEF CNA & SEiR. Support fire prevention at sponsor.erlef.org

I had a great time talking about our cybersecurity work at the @erlef.org together with @maennchen.dev today. The past days have proven that our work is more relevant than ever! 📸 @pragtob.bsky.social

Your AI assistant reads untrusted input for a living. @peterullrich.com and @maennchen.dev are on Track 2 with 'Don't Get Pwned by AI Attacks'. Practical, and probably a little uncomfortable. #CodeBEAM #Security

Some CA certs are compromised. Update to maintain TLS security. See com.erlef.org/wg/sec/2026/...

@peterullrich.com recently ran a huge security scan on all of #AshFramework repositories. He found a lot, we fixed them all, and I wrote a bit about it here: ash-hq.org/blog/concent...

Our conference report has been written. It is insufficient. Please tell us your favorite parts of whatever this was. underjord.io/goatmire-2-o... We struggle to find enough words. #goatmire #elixirlang

Gleam v1.19.0 is out now! gleam.run/news/gleam-d...

I'm pleased to announce our newest #AshFramework core team member: @maennchen.dev ! He has been a steadfast partner for well over a year now, and has helped secure the Ash ecosystem (and to a much greater degree the Elixir/BEAM ecosystem as a whole). He also built an entire CNA platform with Ash 😎

📢 Announcing @ash-hq.org's newest feature 📢 Temporal Resources 😎 ash-hq.org/blog/introdu... #ElixirLang #AshFramework

Watch: Paraxial.io Founder Michael Lubas and EEF CISO Jonatan Männchen at ElixirConf US 2026 - Pentesting Hex: Real Findings from the Ægis Initiative @maennchen.dev @elixirconf.bsky.social www.youtube.com/watch?v=_fER...

@maennchen.dev & @peterullrich.com share how they found and fixed ~100 vulnerabilities across the top 1000 Hex packages, using AI to make the ecosystem safer at Code BEAM Europe 2026. 📅 21–22 Oct | Haarlem, NL | In-person & Virtual https://codebeameurope.com/#register

Now on Track 1: 'Pentesting Hex: Real Findings from the Ægis Initiative' with Michael Lubas & Jonatan Männchen (@maennchen.dev) #ElixirConf #ElixirConfUS #ElixirConfUS2026 #security #hex

Our self() defense is a process, here's the pid: com.erlef.org/wg/sec/2026/...

New release of OTP with vulnerability fixes. com.erlef.org/wg/cna/2026/...

We are happy to announce that Oban Pro oban.pro has joined in financial support for the EEF. com.erlef.org/wg/sup/2026/... @oban.pro

Come join us in Chicago!

UnConferences before ElixirConf US and CodeBEAM Europe, September 9 and October 20, respectively. More info at com.erlef.org/wg/com/2026/...

New #ElixirLang ERLEF sponsor site is up, hopefully providing much clearer impact sponsors have on the community sponsor.erlef.org If you're at a company that uses the BEAM, send the site to your CFO and give back!

@maennchen.dev will be at @elixirconf.bsky.social presenting "Pentesting Hex: Real Findings from the Ægis Initiative," alongside Michael Lubas. They will share results from two real-world penetration tests of Hex, funded through our Ægis Initiative. elixirconf.com/talks/pentes...

The hexpm package pages are now generated by MDEx and Lumis, thanks to @maennchen.dev ! - Better GitHub Flavored Markdown - Light/Dark themes - Syntax highlighting for more languages and sigils - HEEx, Python, Lua, Svelte, React, etc And more... #MyElixirStatus

Catch my keynote at @elixirconf.bsky.social in September😎. I'll be talking about how to augment and empower large engineering teams with AI 🤖. I've also got some spicy topics for you all, not shying away from the hard questions of the day 👊 elixirconf.com/talks/exoske...

HexDocs URLs are changing! Public package docs move from hexdocs.pm/package to package.hexdocs.pm, and private organization docs move from org.hexdocs.pm/package to org.hexorgs.pm/package Funded by Alpha-Omega through EEF's Ægis initiative. Learn more 👇 hex.pm/blog/hexdocs...

Our CISO @maennchen.dev joined this episode to talk about what securing the BEAM ecosystem actually looks like today — CVE coordination, the EEF's CNA, and what's changed. www.youtube.com/watch?v=FulS...

The Beam There, Done That podcast episode with me and @maennchen.dev is out! www.youtube.com/watch?v=FulS...

One third is a wild number. 😂 Atom exhaustion is one of those BEAM-specific issues that feels obvious once you know it, but keeps showing up in real vulnerabilities. Worth a read if you maintain #ElixirLang / #Erlang libraries or apps.

Atom exhaustion is not just an old BEAM footgun. As of today, 35% of CVEs published by the EEF CNA fall under uncontrolled resource consumption, with atom exhaustion being one of the recurring causes. It’s well understood, documented, and preventable. erlef.org/blog/securit...

🚨 Update hackney 🚨 A **bunch** of vulnerabilities I reported in hackney were just disclosed. Please upgrade to 4.0.1 ASAP. I know this is gonna start dependency hell so please take some time for this. Please RT for reach. #ElixirLang cna.erlef.org/cves/

If you’re running #Phoenix Channels (or LiveView) and have the LongPoll option enabled in your endpoint (default since 1.7.11), it’s time to do an update: github.com/phoenixframe... Thank you @peterullrich.com for finding and disclosing this issue!

The 5 vulnerabilities I found in Bandit were fixed and released today. Please go upgrade bandit ASAP. Thanks to @mtrudel.bsky.social for fixing them so quickly and to @maennchen.dev for managing the process 🙏 #ElixirLang cna.erlef.org/cves/

Securing Hex, the Backbone of the Elixir Ecosystem paraxial.io/blog/hex-pen...

Scaling Security from Zero by @maennchen.dev CISO of our Foundation! Learn how a Small OSS Ecosystem Jumped Into the Deep End! Jonatan talk at Code & Compliance is now live: www.youtube.com/watch?v=jl89...

Can Erlang run on QNX? Turns out: yes ✅ In this article, @maennchen.dev explores what it takes to port Erlang/OTP to QNX. A great example of curiosity turning into concrete results. erlef.org/blog/eef/otp...

Hi Elixir friends, After 3 years on Hologram full-time (transpiles Elixir to the browser), I'm at a crossroads. 60+ hr weeks balancing contracts & dev isn't sustainable. Where we are & how you can help: hologram.page/blog/seeking... Even sharing helps 💜 #Hologram #Elixir #ElixirLang #BEAM #WebDev

I really like what Hologram is building, there’s a lot of potential there to take it further. If you haven’t yet, consider sponsoring. I just did myself. Feels like one of those projects where a bit of support now could have a big impact later. bsky.app/profile/bart...

The Erlang Ecosystem Foundation CNA now publishes vulnerability data directly to OSV.dev. No more relying solely on CVE→OSV conversion. This update means faster, cleaner, and higher-quality security data for the BEAM ecosystem — including Erlang, Elixir, Gleam, and Hex.pm.

At Code BEAM Europe 2025 @maennchen.dev : War stories from a security disaster. What to do when everything breaks.

🗓️ Nov 7- BEAM Unconference 1000-1500 7/11 luma.com/qyfevatp Lightning talks, deep dives & community.

💜 @elixir-lang.org v1.19 is the first release with OpenChain certification — bringing more transparency and trust to the BEAM ecosystem. Big thanks to @maennchen.dev and our sponsor Herrmann Ultraschall for making this milestone possible! 👏 🔗 elixir-lang.org/blog/2025/02... #Elixilang

Hey folks! We have a CVE up for #AshFramework bypass policies. It's a *highly unlikely edge case*. But, as always, we take security extremely seriously and will always follow proper procedure here. Props to @maennchen.dev for reporting and resolving 🙇

Elixir Radar issue 486 is out! 📣 You can read it here: buff.ly/2UM7hp6 This issue comes with content from @shahryar-tbiz.bsky.social @katafrakt.bsky.social @maennchen.dev @elixircasts.io , Matt Savoia and Yatender Singh . Thank you! #ElixirLang

We have made major progress toward CRA readiness for the BEAM ecosystem! 🔙So far: CNA operations, OpenChain certification, and more already in place. 🔜Next up: signed OTP builds to lower compliance costs and strengthen sustainability. security.erlef.org/assets/aegis...

Another 🔥 package release from @maennchen.dev 😎 AshDiagram is a library for generating beautiful diagrams to visualize your #AshFramework applications. Generate Entity Relationship, Class, C4 Architecture, and Policy diagrams directly from your Ash resources and domains. 🚀

What if the BEAM got hit by a worm? 🪱 We’ve been lucky so far — but luck runs out. The Ægis Initiative is how we defend our ecosystem. 👉 Read more & support: erlef.org/blog/eef/bea... #Erlang #Elixirlag #Gleam

One package. One update. A worm crawling through the BEAM ecosystem. A dark “what if” — and how we can stop it before it’s real. erlef.org/blog/securit... #erlang #elixirlang

There‘s still a bit to go to making this happen. Rebar is an important piece to using erlang not just for erlang, but just as much for elixir, gleam, … Consider backing this effort.

@maennchen.dev has just released the first version of Clarity: hexdocs.pm/clarity/Clar... Clarity is an interactive introspection and visualization tool for Elixir projects.

Cool!!! @maennchen.dev introduces Clarity! @ash-hq.org #elixirlang