Elixir

Use consistent exception names

Exception modules should consistently use the conventional Error suffix.

defmodule PaymentException, do: defexception([:message])
defmodule RefundError, do: defexception([:message])

defmodule PaymentError, do: defexception([:message])
defmodule RefundError, do: defexception([:message])

Use consistent line endings

Mixing Unix (LF) and Windows (CRLF) line endings creates noisy diffs and inconsistent formatting.

lib/user.ex     LF
lib/account.ex  CRLF

lib/user.ex     LF
lib/account.ex  LF

Use consistent parameter pattern matching

When naming a matched parameter, place the variable consistently before or after the pattern.

def parse({:ok, value} = result), do: {result, value}
def save(result = {:ok, value}), do: {result, value}

def parse({:ok, value} = result), do: {result, value}
def save({:ok, value} = result), do: {result, value}

Use consistent spacing around operators

Consistent whitespace around operators makes expressions easier to scan.

total=price*quantity

total = price * quantity

Use consistent spacing inside parentheses

Do not add unnecessary spaces immediately inside parentheses.

calculate( price, quantity )

calculate(price, quantity)

Use consistent indentation

Use spaces consistently instead of mixing tab- and space-indented lines.

def run do
  prepare() # tab-indented in the source file
  execute() # space-indented in the source file
end

def run do
  prepare()
  execute()
end

Alias nested modules

Alias nested dependencies so a module’s external dependencies are visible at a glance.

def search(query) do
  MyApp.External.SearchClient.run(query)
end

alias MyApp.External.SearchClient

def search(query), do: SearchClient.run(query)

Resolve FIXME tags

FIXME tags identify known broken or unsafe behavior that should be corrected.

# FIXME: accept every role until authorization is implemented
def authorized?(_user), do: true

def authorized?(%User{role: role}), do: role in [:admin, :editor]

Resolve TODO tags

Replace incomplete TODO placeholders with the intended implementation.

# TODO: persist this user
def create_user(attrs), do: {:ok, attrs}

def create_user(attrs), do: Repo.insert(User.changeset(%User{}, attrs))

Order aliases consistently

Keep aliases alphabetically ordered so dependencies are easy to find.

alias MyApp.Users
alias MyApp.Accounts

alias MyApp.Accounts
alias MyApp.Users

Use conventional function names

Elixir function names should use lowercase snake_case and may end in ? or !.

def LoadUser(user_id), do: Repo.get(User, user_id)

def load_user(user_id), do: Repo.get(User, user_id)

Make large numbers readable

Add underscore separators to large numeric literals.

upload_limit = 10000000

upload_limit = 10_000_000

Keep lines within the maximum length

Split long expressions into named values or multiple lines.

Logger.info("created user #{user.id} for organization #{organization.id} with permissions #{inspect(permissions)}")

metadata = "organization #{organization.id}, permissions #{inspect(permissions)}"
Logger.info("created user #{user.id} for #{metadata}")

Use conventional module attribute names

Module attributes should use lowercase snake_case.

@RetryLimit 3

@retry_limit 3

Document modules

Public modules should explain their purpose with @moduledoc.

defmodule MyApp.Invoice do
  def total(invoice), do: invoice.subtotal + invoice.tax
end

defmodule MyApp.Invoice do
  @moduledoc "Calculates invoice totals."
  def total(invoice), do: invoice.subtotal + invoice.tax
end

Use conventional module names

Module names should use CamelCase without underscores.

defmodule MyApp.User_Profile do
end

defmodule MyApp.UserProfile do
end

Avoid unnecessary parentheses in conditions

Elixir conditions do not need surrounding parentheses.

if (user.active?) do
  send_welcome(user)
end

if user.active? do
  send_welcome(user)
end

Avoid parentheses on zero-arity definitions

Zero-arity function definitions conventionally omit parentheses.

def current_time(), do: DateTime.utc_now()

def current_time, do: DateTime.utc_now()

Avoid piping into anonymous functions

Assign or invoke an anonymous function directly instead of hiding the call in a pipeline.

value
|> (fn item -> normalize(item) end).()

normalizer = fn item -> normalize(item) end
normalizer.(value)

Use conventional predicate function names

Functions returning booleans should end in ?; reserve is_ names for guards.

def is_active(user), do: user.status == :active

def active?(user), do: user.status == :active

Prefer implicit try

Function-level rescue, catch, and after clauses are clearer without a redundant try.

def load(path) do
  try do
    File.read!(path)
  rescue
    File.Error -> :error
  end
end

def load(path) do
  File.read!(path)
rescue
  File.Error -> :error
end

Remove redundant blank lines

Use a single blank line to separate related sections.

def first, do: :ok

def second, do: :ok

def first, do: :ok

def second, do: :ok

Avoid semicolons

Put expressions on separate lines instead of separating them with semicolons.

user = load_user(id); notify(user)

user = load_user(id)
notify(user)

Add spaces after commas

Commas should be followed by a space.

create_user(name,email,role)

create_user(name, email, role)

Use string sigils when they improve readability

Sigils remove distracting escape characters from strings containing many quotes.

html = "<a href=\"/docs\" target=\"_blank\">Docs</a>"

html = ~S(<a href="/docs" target="_blank">Docs</a>)

End files with a trailing newline

End every source file with exactly one newline for portable tooling and clean diffs.

defmodule MyApp.User do
end[EOF]

defmodule MyApp.User do
end
[newline][EOF]

Remove trailing whitespace

Remove invisible spaces and tabs at the end of source lines.

name = "Ada"[four trailing spaces]

name = "Ada"

Avoid unnecessary alias expansion

Use the alias directly instead of repeating its namespace.

alias MyApp.Accounts
MyApp.Accounts.create_user(attrs)

alias MyApp.Accounts
Accounts.create_user(attrs)

Use conventional variable names

Variables should use lowercase snake_case.

UserName = "Ada"

user_name = "Ada"

Use case for a single-clause with

A with containing one match and an else branch is clearer as a case.

with {:ok, user} <- Accounts.fetch_user(id) do
  user
else
  {:error, reason} -> raise "failed: #{inspect(reason)}"
end

case Accounts.fetch_user(id) do
  {:ok, user} -> user
  {:error, reason} -> raise "failed: #{inspect(reason)}"
end

Prefer direct function calls over apply

When the target and argument count are known, call the function directly.

apply(String, :upcase, [name])

String.upcase(name)

Simplify short cond expressions

A cond with one condition plus a fallback should be an if/else.

cond do
  score >= 60 -> :pass
  true -> :fail
end

if score >= 60 do
  :pass
else
  :fail
end

Reduce cyclomatic complexity

Too many branches make functions difficult to understand and test. Extract named decisions.

def price(order) do
  cond do
    order.vip? and order.total > 100 -> order.total * 0.8
    order.vip? -> order.total * 0.9
    order.total > 100 -> order.total * 0.95
    true -> order.total
  end
end

def price(order), do: order.total * discount(order)
defp discount(%{vip?: true, total: total}) when total > 100, do: 0.8
defp discount(%{vip?: true}), do: 0.9
defp discount(%{total: total}) when total > 100, do: 0.95
defp discount(_order), do: 1.0

Use Enum.count with a predicate

Count matching elements in one pass with Enum.count/2.

users
|> Enum.filter(& &1.active?)
|> Enum.count()

Enum.count(users, & &1.active?)

Combine consecutive filters

Combining predicates avoids traversing an intermediate collection.

users
|> Enum.filter(& &1.active?)
|> Enum.filter(&(&1.age >= 18))

Enum.filter(users, fn user ->
  user.active? and user.age >= 18
end)

Limit function arity

Too many parameters make calls error-prone. Group related values into a struct or map.

def create_user(name, email, role, team, locale, timezone) do
  # ...
end

def create_user(%UserParams{} = params) do
  # ...
end

Keep quote blocks concise

Large quoted AST blocks should delegate to smaller macros or helper functions.

quote do
  def start, do: :ok
  def stop, do: :ok
  def restart, do: :ok
  def status, do: :running
end

quote do
  unquote(lifecycle_functions())
  unquote(status_function())
end

Use Enum.map_join

Map and join in one traversal with Enum.map_join/3.

users
|> Enum.map(& &1.name)
|> Enum.join(", ")

Enum.map_join(users, ", ", & &1.name)

Avoid matches in conditions

Use case when control flow depends on the shape of a value.

if {:ok, contents} = File.read(path) do
  process(contents)
end

case File.read(path) do
  {:ok, contents} -> process(contents)
  {:error, reason} -> handle_error(reason)
end

Avoid negated conditions in unless

A negated unless condition is a double negative.

unless not user.active? do
  notify(user)
end

if user.active? do
  notify(user)
end

Invert negated conditions with else

Put the positive condition first and swap the branches.

if not authorized?(user) do
  {:error, :forbidden}
else
  perform_action(user)
end

if authorized?(user) do
  perform_action(user)
else
  {:error, :forbidden}
end

Reduce control-flow nesting

Extract nested decisions into functions or use pattern matching and early returns.

if user do
  if user.active? do
    if user.admin?, do: grant_access(user)
  end
end

def grant_if_allowed(%User{active?: true, admin?: true} = user),
  do: grant_access(user)

def grant_if_allowed(_user), do: {:error, :forbidden}

Remove redundant with clause results

Do not match the final result only to return the identical value.

with {:ok, user} <- Accounts.fetch_user(id),
     {:ok, result} <- authorize(user) do
  {:ok, result}
end

with {:ok, user} <- Accounts.fetch_user(id) do
  authorize(user)
end

Combine consecutive rejects

Combine predicates to avoid traversing an intermediate collection.

users
|> Enum.reject(& &1.disabled?)
|> Enum.reject(& &1.deleted?)

Enum.reject(users, fn user ->
  user.disabled? or user.deleted?
end)

Avoid unless with else

An unless with an else branch is easier to understand as an if.

unless user.active? do
  deactivate_session(user)
else
  refresh_session(user)
end

if user.active? do
  refresh_session(user)
else
  deactivate_session(user)
end

Keep with clauses focused on matching

Move ordinary assignments before with and side-effect calls into its body.

with ref = make_ref(),
     {:ok, user} <- Accounts.create_user(ref),
     Logger.info("created #{user.id}") do
  user
end

ref = make_ref()

with {:ok, user} <- Accounts.create_user(ref) do
  Logger.info("created #{user.id}")
  user
end

Do not store runtime configuration in module attributes

Module attributes are evaluated at compile time and can freeze environment-specific configuration.

@pool_size Application.get_env(:my_app, :pool_size)
def pool_size, do: @pool_size

def pool_size do
  Application.fetch_env!(:my_app, :pool_size)
end

Avoid boolean operations on the same value

Repeating the same boolean operand is redundant and may hide a typo.

ready? and ready?

ready?

Remove dbg calls

dbg/2 is intended for local debugging and should not remain in committed application code.

user = Accounts.fetch_user!(id) |> dbg()

user = Accounts.fetch_user!(id)

Avoid expensive empty-enumerable checks

Use Enum.empty?/1 instead of traversing an enumerable to count every element.

Enum.count(users) == 0

Enum.empty?(users)

Remove IEx.pry calls

IEx.pry pauses a running process and must not remain in application code.

def handle_request(conn) do
  IEx.pry()
  process(conn)
end

def handle_request(conn) do
  process(conn)
end

Remove IO.inspect calls

Replace temporary console inspection with intentional structured logging when diagnostics are needed.

user
|> IO.inspect(label: "loaded user")
|> authorize()

Logger.debug("loaded user", user_id: user.id)
authorize(user)

Configure Logger metadata keys

Metadata passed to Logger should be included in the formatter configuration so it is not silently omitted.

# config: metadata: [:request_id]
Logger.error("payment failed", error_code: :card_declined)

# config: metadata: [:request_id, :error_code]
Logger.error("payment failed", error_code: :card_declined)

Avoid operations on the same value

Using the same expression on both sides often produces a trivial result or signals a copy-paste error.

remaining = total - total

remaining = total - paid

Avoid operations with constant results

Replace expressions whose result cannot change with the value they represent.

discounted_total = total * 0

discounted_total = 0

Preserve stack traces when raising inside rescue

Use reraise/2 when translating an exception so the original stack trace is retained.

rescue
  error -> raise MyApp.LoadError, message: Exception.message(error)

rescue
  error ->
    wrapped = MyApp.LoadError.exception(message: Exception.message(error))
    reraise wrapped, __STACKTRACE__

Reference struct types correctly in specs

Referencing Module.t() avoids an unnecessary compile-time dependency on a struct literal.

@spec send_email(%MyApp.User{}) :: :ok

@spec send_email(MyApp.User.t()) :: :ok

Avoid unsafe command execution

Do not send a constructed command string through a shell. Pass a fixed executable and separate arguments.

:os.cmd(~c"convert #{input_path} output.png")

System.cmd("convert", [input_path, "output.png"])

Use Enum operation results

Enum functions return new values; they do not mutate the input collection.

Enum.sort(users)
render(users)

sorted_users = Enum.sort(users)
render(sorted_users)

Use File operation results

Handle the success or error returned by File operations.

File.write(path, contents)
:ok

case File.write(path, contents) do
  :ok -> :ok
  {:error, reason} -> {:error, reason}
end

Use Keyword operation results

Keyword functions return updated lists and do not mutate the original.

Keyword.put(options, :timeout, 5_000)
request(options)

options = Keyword.put(options, :timeout, 5_000)
request(options)

Use List operation results

List functions return updated lists and do not mutate the original.

List.delete(users, deleted_user)
notify(users)

users = List.delete(users, deleted_user)
notify(users)

Use Path operation results

Use the path returned by Path functions.

Path.expand(path)
File.read(path)

expanded_path = Path.expand(path)
File.read(expanded_path)

Use Regex operation results

Use the value returned by Regex operations.

Regex.replace(~r/\s+/, value, " ")
save(value)

normalized = Regex.replace(~r/\s+/, value, " ")
save(normalized)

Use String operation results

Strings are immutable, so transformation results must be used.

String.trim(name)
create_user(name)

name = String.trim(name)
create_user(name)

Use Tuple operation results

Tuple operations return a new tuple and do not mutate the original.

Tuple.append(point, z)
draw(point)

point = Tuple.append(point, z)
draw(point)

Use the correct test file extension

ExUnit test files should use .exs so they are executed as scripts by the test runner.

test/my_app/user_test.ex

test/my_app/user_test.exs

Do not evaluate untrusted Elixir code

Values derived from a request must not reach Code.eval_*, which executes code with the application’s privileges.

def evaluate(conn) do
  Code.eval_string(conn.params["expression"])
end

def evaluate(conn) do
  expression = conn.params["expression"]
  SafeExpressionParser.evaluate(expression)
end

Do not dynamically apply untrusted functions

Untrusted values must not choose the module or function passed to apply/3.

def dispatch(params) do
  apply(String.to_existing_atom(params["module"]), params["function"], [])
end

def dispatch(%{"action" => "refresh"}), do: Sessions.refresh()
def dispatch(%{"action" => "logout"}), do: Sessions.logout()
def dispatch(_params), do: {:error, :unsupported_action}

Do not evaluate untrusted EEx templates

EEx templates can execute Elixir code, so only application-owned template source should be evaluated.

def preview(conn) do
  EEx.eval_string(conn.params["template"], assigns: conn.assigns)
end

def preview(conn) do
  Phoenix.Template.render(MyAppWeb, "preview", "html", conn.assigns)
end

Do not load untrusted native libraries

An attacker-controlled path passed to :erlang.load_nif can execute arbitrary native code.

def load_native(conn) do
  :erlang.load_nif(conn.params["library"], 0)
end

@library Path.join(:code.priv_dir(:my_app), "native/my_app_nif")
def load_native, do: :erlang.load_nif(@library, 0)

Avoid command injection through :os.cmd

:os.cmd invokes a command processor and must not receive constructed or untrusted commands.

def lookup(conn) do
  :os.cmd(~c"nslookup #{conn.params["host"]}")
end

def lookup(conn) do
  host = validate_hostname!(conn.params["host"])
  System.cmd("nslookup", [host])
end

Avoid command injection through Port.open

Do not let untrusted input select a command or shell string passed to Port.open.

def run(conn) do
  Port.open({:spawn, conn.params["command"]}, [:binary])
end

def run(argument) do
  executable = System.find_executable("convert")
  Port.open({:spawn_executable, executable}, [{:args, [argument]}, :binary])
end

Validate System.cmd commands and arguments

Use a fixed executable and validate every argument before passing it to System.cmd.

def convert(conn) do
  System.cmd(conn.params["program"], conn.params["arguments"])
end

def convert(conn) do
  input = validate_image_path!(conn.params["input"])
  System.cmd("convert", [input, "output.png"])
end

Avoid command injection through System.shell

System.shell invokes a system shell and must not receive untrusted input.

def archive(conn) do
  System.shell("tar -czf archive.tgz #{conn.params["path"]}")
end

def archive(conn) do
  path = validate_archive_path!(conn.params["path"])
  System.cmd("tar", ["-czf", "archive.tgz", path])
end

Validate Phoenix WebSocket origins

Disabling socket origin checks allows malicious sites to open authenticated cross-origin WebSocket connections.

socket "/socket", MyAppWeb.UserSocket,
  websocket: [check_origin: false]

socket "/socket", MyAppWeb.UserSocket,
  websocket: [check_origin: ["https://app.example.com"]]

Avoid wildcard CORS origins

A wildcard CORS policy can allow arbitrary websites to read authenticated responses.

plug CORSPlug, origin: "*"

plug CORSPlug, origin: ["https://app.example.com"]

Do not reuse state-changing actions for GET routes

A controller action that changes state must not also be reachable by GET, which is not protected as a state-changing request.

get "/account/delete", AccountController, :delete
delete "/account", AccountController, :delete

get "/account", AccountController, :show
delete "/account", AccountController, :delete

Disable Phoenix debug errors outside development

Detailed error pages can disclose stack traces, source code, and request data.

config :my_app, MyAppWeb.Endpoint,
  debug_errors: true

config :my_app, MyAppWeb.Endpoint,
  debug_errors: false

Enable Phoenix force_ssl in production

Production endpoints should redirect HTTP to HTTPS and enable transport protections.

config :my_app, MyAppWeb.Endpoint,
  force_ssl: false

config :my_app, MyAppWeb.Endpoint,
  force_ssl: [rewrite_on: [:x_forwarded_proto]]

Secure session cookies

Session cookies should use secure, http_only, and an appropriate SameSite policy.

plug Plug.Session,
  store: :cookie,
  key: "_my_app_key",
  secure: false,
  http_only: false

plug Plug.Session,
  store: :cookie,
  key: "_my_app_key",
  secure: true,
  http_only: true,
  same_site: "Lax"

Configure a Content Security Policy

Secure browser headers should include a restrictive Content Security Policy to reduce the impact of XSS.

plug :put_secure_browser_headers, %{}

plug :put_secure_browser_headers, %{
  "content-security-policy" => "default-src 'self'; object-src 'none'"
}

Enable CSRF protection in browser pipelines

Every browser pipeline that fetches a cookie-backed session and accepts state changes should use :protect_from_forgery.

pipeline :browser do
  plug :accepts, ["html"]
  plug :fetch_session
end

pipeline :browser do
  plug :accepts, ["html"]
  plug :fetch_session
  plug :protect_from_forgery
end

Enable secure browser headers

HTML pipelines should install Phoenix’s standard security headers.

pipeline :browser do
  plug :accepts, ["html"]
  plug :fetch_session
end

pipeline :browser do
  plug :accepts, ["html"]
  plug :fetch_session
  plug :put_secure_browser_headers
end

Use cryptographically secure randomness

Pseudo-random generators such as :rand must not create tokens, credentials, or other security-sensitive values.

reset_token = :rand.uniform(1_000_000) |> Integer.to_string()

reset_token =
  :crypto.strong_rand_bytes(32)
  |> Base.url_encode64(padding: false)

Avoid weak cryptographic hashes

MD5 and SHA-1 are collision-prone. Use SHA-256 or stronger for integrity and a password-hashing function for passwords.

digest = :crypto.hash(:sha, payload)

digest = :crypto.hash(:sha256, payload)

Avoid atom-table exhaustion

Atoms are not garbage collected, so untrusted strings must not be converted into new atoms.

role = String.to_atom(conn.params["role"])

def parse_role("admin"), do: {:ok, :admin}
def parse_role("member"), do: {:ok, :member}
def parse_role(_role), do: {:error, :invalid_role}

Do not compile untrusted regular expressions

Attacker-controlled patterns can trigger excessive backtracking and consume scheduler time.

def search(conn, value) do
  Regex.run(Regex.compile!(conn.params["pattern"]), value)
end

@allowed_patterns %{"email" => ~r/^[^\s]+@[^\s]+$/}
def search(conn, value) do
  Regex.run(Map.fetch!(@allowed_patterns, conn.params["pattern"]), value)
end

Do not deserialize untrusted Erlang terms

:erlang.binary_to_term can allocate attacker-controlled terms and deserialize executable functions.

def decode(conn) do
  :erlang.binary_to_term(conn.body_params["data"])
end

def decode(conn) do
  Jason.decode(conn.body_params["data"])
end

Prevent open redirects

Do not let a request parameter select an arbitrary external redirect destination.

def continue(conn, %{"next" => next}) do
  redirect(conn, external: next)
end

def continue(conn, %{"next" => "dashboard"}) do
  redirect(conn, to: ~p"/dashboard")
end

def continue(conn, _params), do: redirect(conn, to: ~p"/")

Prevent filesystem path traversal

Do not pass request-controlled paths directly to filesystem APIs.

def read(conn) do
  File.read(conn.params["path"])
end

@documents %{"guide" => "guide.pdf", "terms" => "terms.pdf"}
def read(conn) do
  filename = Map.fetch!(@documents, conn.params["document"])
  File.read(Path.join(:code.priv_dir(:my_app), "documents/#{filename}"))
end

Prevent path traversal in send_download

Resolve a trusted identifier to a server-owned file instead of accepting a download path from the request.

def download(conn, %{"path" => path}) do
  send_download(conn, {:file, path})
end

def download(conn, %{"report" => report_id}) do
  report = Reports.fetch_authorized!(conn.assigns.current_user, report_id)
  send_download(conn, {:file, report.stored_path})
end

Prevent path traversal in send_file

Only send files resolved beneath an application-owned directory.

def asset(conn) do
  Plug.Conn.send_file(conn, 200, conn.params["path"])
end

@assets %{"logo" => "logo.svg"}
def asset(conn) do
  filename = Map.fetch!(@assets, conn.params["asset"])
  path = Path.join(:code.priv_dir(:my_app), "static/#{filename}")
  Plug.Conn.send_file(conn, 200, path)
end

Use parameterized Ecto SQL queries

Never interpolate request values into raw SQL. Keep SQL text fixed and pass values as parameters.

def find_user(conn) do
  Ecto.Adapters.SQL.query!(Repo, "SELECT * FROM users WHERE id = #{conn.params["id"]}")
end

def find_user(conn) do
  Ecto.Adapters.SQL.query!(
    Repo,
    "SELECT * FROM users WHERE id = $1",
    [conn.params["id"]]
  )
end

Prevent server-side request forgery

Do not let untrusted input control an outbound request URL. Resolve destinations from an allowlist.

def fetch(conn) do
  Req.get!(conn.params["url"])
end

@services %{"billing" => "https://billing.example.com/health"}
def fetch(conn) do
  Req.get!(Map.fetch!(@services, conn.params["service"]))
end

Verify TLS certificates

Disabling certificate verification allows a network attacker to impersonate the remote service.

:httpc.request(:get, {url, []}, [ssl: [verify: :verify_none]], [])

:httpc.request(
  :get,
  {url, []},
  [ssl: [verify: :verify_peer, cacerts: :public_key.cacerts_get()]],
  []
)

Do not let users select response content types

An attacker who selects text/html may turn otherwise inert response data into executable script.

def show(conn) do
  conn
  |> put_resp_content_type(conn.params["content_type"])
  |> send_resp(200, conn.params["body"])
end

def show(conn) do
  conn
  |> put_resp_content_type("application/json")
  |> send_resp(200, Jason.encode!(%{message: conn.params["body"]}))
end

Escape dynamic Phoenix HTML responses

Do not concatenate untrusted data into an HTML response. Render it through Phoenix’s escaping.

def welcome(conn, %{"name" => name}) do
  html(conn, "<h1>Welcome #{name}</h1>")
end

def welcome(conn, %{"name" => name}) do
  render(conn, :welcome, name: name)
end

Do not pass untrusted HTML to raw

raw bypasses Phoenix HTML escaping and can turn request data into executable markup.

raw(@conn.params["message"])

@conn.params["message"]

Do not send untrusted HTML with send_resp

Use a template or an encoder with an explicit non-HTML content type instead of constructing response bodies from request data.

def echo(conn) do
  send_resp(conn, 200, "<p>#{conn.params["message"]}</p>")
end

def echo(conn) do
  body = Jason.encode!(%{message: conn.params["message"]})

  conn
  |> put_resp_content_type("application/json")
  |> send_resp(200, body)
end

Get Started

AI Code Review

Scan Center

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE

CLI

CI/CD

Integrations

Rule Reference

How CodeAnt Uses CodeAnt

Resources