Brakeman is a security scanner for Ruby on Rails applications.
Unlike many web security scanners, Brakeman looks at the source code of your application. This means you do not need to set up your whole application stack to use it.Once Brakeman scans the application code, it produces a report of all security issues it has found.
gem install brakeman
group :development do gem 'brakeman', :require => false end
From a Rails application’s root directory:
Outside of Rails root:
Brakeman should work with any version of Rails from 2.3.x to 5.x.
Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 1.9.3 to run.
For a full list of options, use
brakeman --help or see the OPTIONS.md file.
To specify an output file for the results:
brakeman -o output_file
The output format is determined by the file extension or by using the
-f option. Current options are:
Multiple output files can be specified:
brakeman -o output.html -o output.json
To suppress informational warnings and just output the report:
Note all Brakeman output except reports are sent to stderr, making it simple to redirect stdout to a file and just get the report.
To see all kinds of debugging information:
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (
brakeman -x DefaultRoutes
Multiple checks should be separated by a comma:
brakeman -x DefaultRoutes,Redirect
To do the opposite and only run a certain set of tests:
brakeman -t SQL,ValidationRegex
If Brakeman is running a bit slow, try