Sign in

Jonatan Männchen

@maennchen.dev
146 followers 76 following 31 posts

CISO & Member Security WG @theerlef.bsky.social | he/him

PostsRepliesMedia
Reposted by Jonatan Männchen
Paraxial.io @paraxialio.bsky.social · 14/09/2026
Watch: Paraxial.io Founder Michael Lubas and EEF CISO Jonatan Männchen at ElixirConf US 2026 - Pentesting Hex: Real Findings from the Ægis Initiative @maennchen.dev @elixirconf.bsky.social www.youtube.com/watch?v=_fER...
youtube.com
Pentesting Hex: Real Findings from the Ægis Initiative | Michael Lubas & Jonatan Männchen | ECUS'26
YouTube video by Code Sync
052
Reposted by Jonatan Männchen
Code BEAM @codebeam.bsky.social · 11/09/2026
@maennchen.dev & @peterullrich.com share how they found and fixed ~100 vulnerabilities across the top 1000 Hex packages, using AI to make the ecosystem safer at Code BEAM Europe 2026. 📅 21–22 Oct | Haarlem, NL | In-person & Virtual codebeameurope.com/#register
073
Reposted by Jonatan Männchen
ElixirConf @elixirconf.bsky.social · 10/09/2026
Now on Track 1: 'Pentesting Hex: Real Findings from the Ægis Initiative' with Michael Lubas & Jonatan Männchen (@maennchen.dev) #ElixirConf #ElixirConfUS #ElixirConfUS2026 #security #hex
052
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 02/09/2026
Our self() defense is a process, here's the pid: com.erlef.org/wg/sec/2026/...
com.erlef.org
Our self() Defense
Defending our ecosystem against AI threats
073
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 02/09/2026
New release of OTP with vulnerability fixes. com.erlef.org/wg/cna/2026/...
com.erlef.org
OTP updates address http and integer vulnerabilities
Remedies for http client and server bugs, integer serialization DoS
052
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 01/09/2026
We are happy to announce that Oban Pro oban.pro has joined in financial support for the EEF. com.erlef.org/wg/sup/2026/... @oban.pro
com.erlef.org
Oban Pro Support
Oban Pro, offering and supporting Oban, the most widely used Elixir queuing system, has become a sponsor of the EEF by providing financial support. Oban Pro layers on the advanced features needed to…
0266
Jonatan Männchen @maennchen.dev · 20/08/2026
Come join us in Chicago!
000
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 04/08/2026
UnConferences before ElixirConf US and CodeBEAM Europe, September 9 and October 20, respectively. More info at com.erlef.org/wg/com/2026/...
com.erlef.org
UnConferences Upcoming 2026
ElixirConf-Sept 9 in Chicago, CodeBEAM Europe-Oct 20 in the Netherlands
021
Reposted by Jonatan Männchen
David Bernheisel @david.bernheisel.com · 14/08/2026
New #ElixirLang ERLEF sponsor site is up, hopefully providing much clearer impact sponsors have on the community sponsor.erlef.org If you're at a company that uses the BEAM, send the site to your CFO and give back!
sponsor.erlef.org
Support the Erlang Ecosystem Foundation
Sponsorship powers our working groups, security advisories, and the events the BEAM community runs on.
01212
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 21/07/2026
@maennchen.dev will be at @elixirconf.bsky.social presenting "Pentesting Hex: Real Findings from the Ægis Initiative," alongside Michael Lubas. They will share results from two real-world penetration tests of Hex, funded through our Ægis Initiative. elixirconf.com/talks/pentes...
elixirconf.com
Pentesting Hex: Real Findings from the Ægis Initiative
Every Elixir developer uses the Hex package manager to ship their project. Businesses, universities, and even governments all rely on this critical infrastructure to adopt Elixir and deliver high…
051
Reposted by Jonatan Männchen
Leandro Pereira @leandrocp.bsky.social · 16/06/2026
The hexpm package pages are now generated by MDEx and Lumis, thanks to @maennchen.dev ! - Better GitHub Flavored Markdown - Light/Dark themes - Syntax highlighting for more languages and sigils - HEEx, Python, Lua, Svelte, React, etc And more... #MyElixirStatus
0254
Reposted by Jonatan Männchen
Zach Daniel @zachdaniel.dev · 30/05/2026
Catch my keynote at @elixirconf.bsky.social in September😎. I'll be talking about how to augment and empower large engineering teams with AI 🤖. I've also got some spicy topics for you all, not shying away from the hard questions of the day 👊 elixirconf.com/talks/exoske...
elixirconf.com
Exoskeletons, not Autopilots
There is a lot of talk these days of peril for the software engineering industry. The fundamental thesis is that you will soon be able to dispatch work to an agent, or a ““swarm”” of agents to build y...
2244
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 01/06/2026
HexDocs URLs are changing! Public package docs move from hexdocs.pm/package to package.hexdocs.pm, and private organization docs move from org.hexdocs.pm/package to org.hexorgs.pm/package Funded by Alpha-Omega through EEF's Ægis initiative. Learn more 👇 hex.pm/blog/hexdocs...
org.hexdocs.pm
0114
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 29/05/2026
Our CISO @maennchen.dev joined this episode to talk about what securing the BEAM ecosystem actually looks like today — CVE coordination, the EEF's CNA, and what's changed. www.youtube.com/watch?v=FulS...
youtube.com
AI Found 5 CVEs in One Afternoon — The BEAM Security Wake-Up Call | Peter Ullrich & Jonathan Machen
YouTube video by BEAM There, Done That
0134
Reposted by Jonatan Männchen
Peter Ullrich @peterullrich.com · 29/05/2026
The Beam There, Done That podcast episode with me and @maennchen.dev is out! www.youtube.com/watch?v=FulS...
youtube.com
AI Found 5 CVEs in One Afternoon — The BEAM Security Wake-Up Call | Peter Ullrich & Jonathan Machen
YouTube video by BEAM There, Done That
0104
Reposted by Jonatan Männchen
Zach Daniel @zachdaniel.dev · 27/05/2026
One third is a wild number. 😂 Atom exhaustion is one of those BEAM-specific issues that feels obvious once you know it, but keeps showing up in real vulnerabilities. Worth a read if you maintain #ElixirLang / #Erlang libraries or apps.
091
Jonatan Männchen @maennchen.dev · 27/05/2026
Atom exhaustion is not just an old BEAM footgun. As of today, 35% of CVEs published by the EEF CNA fall under uncontrolled resource consumption, with atom exhaustion being one of the recurring causes. It’s well understood, documented, and preventable. erlef.org/blog/securit...
erlef.org
Erlang Ecosystem Foundation - Supporting the BEAM community
0329
Reposted by Jonatan Männchen
Peter Ullrich @peterullrich.com · 25/05/2026
🚨 Update hackney 🚨 A **bunch** of vulnerabilities I reported in hackney were just disclosed. Please upgrade to 4.0.1 ASAP. I know this is gonna start dependency hell so please take some time for this. Please RT for reach. #ElixirLang cna.erlef.org/cves/
cna.erlef.org
List of Issued CVE’s
This project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).
43023
Reposted by Jonatan Männchen
Steffen Deusch @steffend.me · 05/05/2026
If you’re running #Phoenix Channels (or LiveView) and have the LongPoll option enabled in your endpoint (default since 1.7.11), it’s time to do an update: github.com/phoenixframe... Thank you @peterullrich.com for finding and disclosing this issue!
github.com
Long-poll NDJSON body splitting causes large memory allocation in Phoenix
### Summary An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client to allocate a large amount of memory with a HTTP request. A handful of conc...
22410
Reposted by Jonatan Männchen
Peter Ullrich @peterullrich.com · 01/05/2026
The 5 vulnerabilities I found in Bandit were fixed and released today. Please go upgrade bandit ASAP. Thanks to @mtrudel.bsky.social for fixing them so quickly and to @maennchen.dev for managing the process 🙏 #ElixirLang cna.erlef.org/cves/
cna.erlef.org
List of Issued CVE’s
This project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).
1347
Reposted by Jonatan Männchen
Paraxial.io @paraxialio.bsky.social · 09/04/2026
Securing Hex, the Backbone of the Elixir Ecosystem paraxial.io/blog/hex-pen...
paraxial.io
Securing Hex, the Backbone of the Elixir Ecosystem
Paraxial.io Completes Security Audit of Hex Package Manager
053
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 13/02/2026
Scaling Security from Zero by @maennchen.dev CISO of our Foundation! Learn how a Small OSS Ecosystem Jumped Into the Deep End! Jonatan talk at Code & Compliance is now live: www.youtube.com/watch?v=jl89...
youtube.com
Scaling Security from Zero: How a Small OSS Ecosystem Jumped Into the Deep End | Jonatan Männchen
YouTube video by Eclipse Foundation
021
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 13/01/2026
Can Erlang run on QNX? Turns out: yes ✅ In this article, @maennchen.dev explores what it takes to port Erlang/OTP to QNX. A great example of curiosity turning into concrete results. erlef.org/blog/eef/otp...
123
Reposted by Jonatan Männchen
Bart Blast @bartblast.com · 27/11/2025
Hi Elixir friends, After 3 years on Hologram full-time (transpiles Elixir to the browser), I'm at a crossroads. 60+ hr weeks balancing contracts & dev isn't sustainable. Where we are & how you can help: hologram.page/blog/seeking... Even sharing helps 💜 #Hologram #Elixir #ElixirLang #BEAM #WebDev
Seeking Sustainable Sponsorship
23531
Jonatan Männchen @maennchen.dev · 28/11/2025
I really like what Hologram is building, there’s a lot of potential there to take it further. If you haven’t yet, consider sponsoring. I just did myself. Feels like one of those projects where a bit of support now could have a big impact later. bsky.app/profile/bart...
130
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 20/11/2025
The Erlang Ecosystem Foundation CNA now publishes vulnerability data directly to OSV.dev. No more relying solely on CVE→OSV conversion. This update means faster, cleaner, and higher-quality security data for the BEAM ecosystem — including Erlang, Elixir, Gleam, and Hex.pm.
197
Reposted by Jonatan Männchen
Code BEAM @codebeam.bsky.social · 05/11/2025
At Code BEAM Europe 2025 @maennchen.dev : War stories from a security disaster. What to do when everything breaks.
021
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 28/10/2025
🗓️ Nov 7- BEAM Unconference 1000-1500 7/11 luma.com/qyfevatp Lightning talks, deep dives & community.
luma.com
BEAM Unconference: Berlin · Luma
⁠Let’s unconference before you go! Wrap up your week with something a little more spontaneous and social, and all about the BEAM ecosystem. The BEAM…
031
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 16/10/2025
💜 @elixir-lang.org v1.19 is the first release with OpenChain certification — bringing more transparency and trust to the BEAM ecosystem. Big thanks to @maennchen.dev and our sponsor Herrmann Ultraschall for making this milestone possible! 👏 🔗 elixir-lang.org/blog/2025/02... #Elixilang
0229
Jonatan Männchen @maennchen.dev · 12/10/2025
I received a small donation mentioning ads.fund, which apparently created a token around my open-source project. I’m not sure what to make of it and would appreciate community input on whether it’s legitimate or something to distance from. github.com/maennchen/Zi...
github.com
💬 Input wanted: ads.fund “Zipstream PHP” token · Issue #382 · maennchen/ZipStream-PHP
Hey everyone, I recently got a small donation through GitHub Sponsors, and the message mentioned something called ads.fund (@ADS-Fund). That made me look into it, and apparently there is a token on...
200
Reposted by Jonatan Männchen
Zach Daniel @zachdaniel.dev · 10/10/2025
Hey folks! We have a CVE up for #AshFramework bypass policies. It's a *highly unlikely edge case*. But, as always, we take security extremely seriously and will always follow proper procedure here. Props to @maennchen.dev for reporting and resolving 🙇
1176
Reposted by Jonatan Männchen
Elixir Radar @elixir-radar.com · 01/10/2025
Elixir Radar issue 486 is out! 📣 You can read it here: buff.ly/2UM7hp6 This issue comes with content from @shahryar-tbiz.bsky.social @katafrakt.bsky.social @maennchen.dev @elixircasts.io , Matt Savoia and Yatender Singh . Thank you! #ElixirLang
buff.ly
Elixir Radar 486
084
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 29/09/2025
We have made major progress toward CRA readiness for the BEAM ecosystem! 🔙So far: CNA operations, OpenChain certification, and more already in place. 🔜Next up: signed OTP builds to lower compliance costs and strengthen sustainability. security.erlef.org/assets/aegis...
132
Reposted by Jonatan Männchen
Zach Daniel @zachdaniel.dev · 29/09/2025
Another 🔥 package release from @maennchen.dev 😎 AshDiagram is a library for generating beautiful diagrams to visualize your #AshFramework applications. Generate Entity Relationship, Class, C4 Architecture, and Policy diagrams directly from your Ash resources and domains. 🚀
1458
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 25/09/2025
What if the BEAM got hit by a worm? 🪱 We’ve been lucky so far — but luck runs out. The Ægis Initiative is how we defend our ecosystem. 👉 Read more & support: erlef.org/blog/eef/bea... #Erlang #Elixirlag #Gleam
053
Jonatan Männchen @maennchen.dev · 24/09/2025
One package. One update. A worm crawling through the BEAM ecosystem. A dark “what if” — and how we can stop it before it’s real. erlef.org/blog/securit... #erlang #elixirlang
091
Reposted by Jonatan Männchen
LostKobrakai @kobrakai.de · 14/09/2025
There‘s still a bit to go to making this happen. Rebar is an important piece to using erlang not just for erlang, but just as much for elixir, gleam, … Consider backing this effort.
1149
Reposted by Jonatan Männchen
Zach Daniel @zachdaniel.dev · 13/09/2025
@maennchen.dev has just released the first version of Clarity: hexdocs.pm/clarity/Clar... Clarity is an interactive introspection and visualization tool for Elixir projects.
2369
Reposted by Jonatan Männchen
Maggie Tate @maggietate.bsky.social · 13/09/2025
Cool!!! @maennchen.dev introduces Clarity! @ash-hq.org #elixirlang
182
Reposted by Jonatan Männchen
Petter Boström @petterbos.bsky.social · 12/09/2025
The first part of the last afternoon gave us insights on how to handle a security disaster, converting from old code to new and our host @lawik.bsky.social showed us thousands of VMs running on the same machine. #goatmire #elixir
063
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 08/09/2025
Proud to back the Rebar4 Kickstarter — moving the BEAM ecosystem forward with the community. 🙌
064
Reposted by Jonatan Männchen
Zach Daniel @zachdaniel.dev · 06/09/2025
Hey folks, we have a CVE for #AshFramework. `before_transaction` hooks will execute in certain scenarios (bulk action calls) even if the action is forbidden by policies. Please update Ash core to 3.5.39. For more see: github.com/ash-project/... #AshFramework #ElixirLang
github.com
Before action hooks may execute in certain scenarios despite a request being forbidden
### Summary Certain bulk action calls with a `before_transaction` hook and no `after_transaction` hook, will call the `before_transaction` hook before authorization is checked and a Forbidden erro...
0184
Reposted by Jonatan Männchen
Louis Pilfold @lpil.uk · 04/09/2025
Stretch goal 2 (inclusion in Erlang/OTP itself) would solve the #1 thing people get stuck on when trying to get started with Gleam or Erlang! www.kickstarter.com/projects/pee...
kickstarter.com
From Rebar3 to Rebar4: Integrating with Erlang/OTP
Building on top of Rebar3 to Fully Integrate with Erlang/OTP for All BEAM Languages, creating Rebar4 the next generation build tool.
0245
Jonatan Männchen @maennchen.dev · 03/09/2025
I just backed From Rebar3 to Rebar4: Integrating with Erlang/OTP on @kickstarter.com www.kickstarter.com/projects/pee... #elixir
kickstarter.com
From Rebar3 to Rebar4: Integrating with Erlang/OTP
Building on top of Rebar3 to Fully Integrate with Erlang/OTP for All BEAM Languages, creating Rebar4 the next generation build tool.
030
Reposted by Jonatan Männchen
ElixirConf @elixirconf.bsky.social · 29/08/2025
Community growth needs collective action Roadmap for outreach and engagement ‪@danj3.bsky.social‬ on taking responsibility for Elixir's future through community championship. #ElixirConfUS
021
Reposted by Jonatan Männchen
ElixirConf @elixirconf.bsky.social · 29/08/2025
Security incident response: from panic to patch CVEs, Hex retirement, vulnerability scanners ‪@maennchen.dev‬shows how to handle security disasters with transparency and leadership.
021
Reposted by Jonatan Männchen
Maggie Tate @maggietate.bsky.social · 28/08/2025
Had a great chat with @zachdaniel.dev and @maennchen.dev during a break at @elixirconf.bsky.social about the Erlang Ecosystem Foundation and its role in security. #elixirlang
193
Reposted by Jonatan Männchen
Code BEAM @codebeam.bsky.social · 22/08/2025
🚀 6 must-see talks at CodeBEAM Europe 2025: Gleam careers, workflow orchestration, VPP with Elixir, security disasters, BEAM+Rust combo, and taming 20M Oban jobs! Featuring @ihh.dev @maennchen.dev codebeameurope.com#register
093
Reposted by Jonatan Männchen
Erlang Ecosystem Foundation @erlef.org · 06/08/2025
👉🏽 "From Freakout to Fix: Navigating a Security Disaster" Our Foundation's CISO - @maennchen.dev - will be speaking at @elixirconf.bsky.social on how to handle serious security holes — without melting down. 📢 Don’t miss it: elixirconf.com/talks/from-f... #ElixirLang #Security #BEAM
053