brakeman
https://github.com/presidentbeef/brakeman
Ruby
A static analysis security vulnerability scanner for Ruby on Rails applications
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
3 Subscribers
Add a CodeTriage badge to brakeman
Help out
- Issues
- Check format validation regexes in non-activerecord models
- Support Rails 7.1+ positional enum syntax in SQL injection check
- Recognize Haml::AttributeBuilder.build_class as an escaped output
- Fix CheckValidationRegex overly broad ignore behaviour
- False positive: `HAML::AttributeBuilder.build_class` incorrectly flagged as XSS
- request: strong params checks for id (key) columns
- Unscoped Find should exclude only if all belongs_to associations are optional
- Parallelise index_call_sites and process_libs: ~75% of scan time is single-threaded on large apps
- False Positive: Regexp containing an escaped $ is marked unsafe
- Add warnings for dangerous content security policy settings autogenerated by Rails
- Docs
- Subscribe to help with docs for this repo and come back later