Hex.pm Security Audit: Results and Next Steps

Hex.pm completed its first comprehensive third-party security audit of the registry and surrounding ecosystem, funded by the OpenSSF Alpha-Omega initiative and performed by Paraxial.io and zentrust partners GmbH across the Erlang, Elixir, and Gleam ecosystems. The audit surfaced issues from high-severity vulnerabilities to hardening gaps — including unsafe deserialization, authentication weaknesses, and CI/CD gaps — most of which have been remediated and confirmed through re-testing.