Module exports all functions despite intended privacy with -export_all

What -export_all actually does

The -export_all compiler attribute instructs the Erlang compiler to export every function defined in the module, regardless of arity or naming convention. Functions intended as private helpers become callable from any other module via Module:Function/Arity or erlang:apply/3. The compiler emits no warning or error for this behavior in OTP 26 and 27.

Confirmed status in current OTP releases

• OTP 26 and 27 still accept -export_all and treat it as a valid attribute.
• The attribute is documented as a legacy feature and discouraged, but no formal deprecation schedule, warning flag, or removal timeline has been announced.
• There is no language-level compile-time guard; static analysis tools (Dialyzer, xref, rebar3_lint, elvis, eqerl) can flag it, but the compiler itself does not.

Recommended migration steps

1. Replace the attribute with an explicit -export([Func/Arity, ...]) list containing only the public API.
2. For metaprogramming cases (dynamic callback modules, generated code), generate the export list at compile time using a parse transform or a build-script that writes the -export directive before compilation.
3. Verify the migrated module with erlang:module_info(exports) or Dialyzer to ensure no unintended functions remain exported.

Scanning a codebase for accidental exposure without execution

• Source grep: grep -r "-export_all" --include="*.erl" . catches direct usage but misses parse-transform injection.
• Beam-level analysis: run rebar3 xref or dialyzer --fullpath on compiled .beam files; both report modules that contain the export_all attribute in their metadata.
• Custom xref query: xref:m(Module) returns the module's export list; if it includes functions not in an explicit -export, the module was compiled with -export_all or a parse transform added it.

One diagnostic detail that changes the recommendation

Does the codebase use parse transforms (e.g., lager_transform, custom transforms) or generated .erl files that might inject -export_all indirectly? If yes, source grep is insufficient and beam-level analysis becomes mandatory.