brakeman
https://github.com/presidentbeef/brakeman
Ruby
A static analysis security vulnerability scanner for Ruby on Rails applications
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
3 Subscribers
Add a CodeTriage badge to brakeman
Help out
- Issues
- `columns_hash` an acceptable whitelist for SQL injections?
- Unscoped find is not detected when using together with includes
- False negative with text_field_tag(name, raw(params[:something]))
- Consider warning on token, password checks that look vulnerable to timing attacks
- Use yard `@return` to resolve "Unresolved Model" errors
- false positive when using .order("FIELD(id, ...)")
- prevent like injection
- False positive - SQL injection when using IDs in second query
- Associations not considered as AR objects
- Idea: Lower priority on XSS model attribute warnings if model validation is present
- Docs
- Subscribe to help with docs for this repo and come back later