Brakeman
(1 votes, average: 5.00 out of 5)
Loading...Brakeman is a security scanner for Ruby on Rails applications.
Unlike many web security scanners, Brakeman looks at the source code of your application. This means you do not need to set up your whole application stack to use it.Once Brakeman scans the application code, it produces a report of all security issues it has found.
Installation
Using RubyGems:
gem install brakeman
Using Bundler:
group :development do
gem 'brakeman', :require => false
end
Usage
From a Rails application’s root directory:
brakeman
Outside of Rails root:
brakeman /path/to/rails/application
Compatibility
Brakeman should work with any version of Rails from 2.3.x to 5.x.
Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 1.9.3 to run.
Basic Options
For a full list of options, use brakeman --help or see the OPTIONS.md file.
To specify an output file for the results:
brakeman -o output_file
The output format is determined by the file extension or by using the -f option. Current options are: text, html, tabs, json, markdown, csv, and codeclimate.
Multiple output files can be specified:
brakeman -o output.html -o output.json
To suppress informational warnings and just output the report:
brakeman -q
Note all Brakeman output except reports are sent to stderr, making it simple to redirect stdout to a file and just get the report.
To see all kinds of debugging information:
brakeman -d
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
brakeman -x DefaultRoutes
Multiple checks should be separated by a comma:
brakeman -x DefaultRoutes,Redirect
To do the opposite and only run a certain set of tests:
brakeman -t SQL,ValidationRegex
If Brakeman is running a bit slow, try
brakeman --faster