A static analysis security vulnerability scanner for Ruby on Rails applications.
Brakeman is a static analysis security scanner specifically designed for Ruby on Rails applications. It analyzes application source code to detect security vulnerabilities such as SQL injection, cross-site scripting (XSS), and insecure redirects without executing the code. The tool helps developers identify and fix security issues early in the development lifecycle.
Ruby on Rails developers, security engineers, and DevOps teams who need to integrate security scanning into their development workflow. It's particularly valuable for teams maintaining Rails applications who want to proactively identify vulnerabilities.
Developers choose Brakeman because it's purpose-built for Rails with deep framework understanding, offers extensive version compatibility, and provides actionable results with confidence levels. Its multiple output formats and Docker support make it easy to integrate into existing CI/CD pipelines.
A static analysis security vulnerability scanner for Ruby on Rails applications
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports Rails versions from 2.3.x to 8.x, making it suitable for both legacy and modern applications without version lock-in.
Generates reports in text, HTML, JSON, JUnit, Markdown, and more, enabling easy integration into diverse CI/CD pipelines and stakeholder workflows.
Assigns High, Medium, or Weak confidence levels to warnings based on certainty, helping developers prioritize the most critical vulnerabilities first.
Offers Docker support with pre-built images, simplifying setup and execution in containerized development and production environments.
The `--faster` mode disables features like library scanning and branching analysis, which the README warns may cause missed vulnerabilities.
HTML reports provide code excerpts, but the README notes that line numbers can be slightly off and source may not accurately reflect warnings due to processing.
Only scans source code without execution, so it cannot detect runtime vulnerabilities or issues in dynamic code paths that emerge during actual use.