Brakeman is a free vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development. Brakeman now uses the parallel gem to read and parse files in parallel. By default, parallel will split the reading/parsing into a number of separate processes based on number of CPUs. In testing, this has dramatically improved speed for large code bases, around 35% reduction in overall scan time. Brakeman will now track and return very simple literal values (e.g. strings, hashes of literals, arrays of literals) from very simple class methods (e.g. single line). Since ActiveRecord enums essentially generate some class (and instance) methods that return fixed literal values, the above class method return values is also used to support enum.

Features

  • Brakeman should work with any version of Rails from 2.3.x to 6.x
  • Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.3.0 to run
  • Brakeman assigns a confidence level to each warning
  • Brakeman options can be stored and read from YAML files
  • To simplify the process of writing a configuration file, the -C option will output the currently set options
  • Options passed in on the commandline have priority over configuration files

Project Samples

Project Activity

See All Activity >

License

Adaptive Public License

Follow Brakeman

Brakeman Web Site

You Might Also Like
MongoDB Atlas runs apps anywhere Icon
MongoDB Atlas runs apps anywhere

Deploy in 115+ regions with the modern database for every enterprise.

MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
Start Free
Rate This Project
Login To Rate This Project

User Reviews

Be the first to post a review of Brakeman!

Additional Project Details

Programming Language

Ruby

Related Categories

Ruby Security Software, Ruby Vulnerability Scanners

Registered

2021-09-03