THthrownaway954·Feb 5, 2020
https://github.com/presidentbeef/brakeman
link to mentioned app for those interested.
In Attacking Ruby on Rails applications (2016)presidentbeef
brakeman
Ruby2012–2020
presidentbeef / brakeman
brakeman
A static analysis security vulnerability scanner for Ruby on Rails applications
9Distinct people
9Mentions
0Explicit recommenders
7.3KGitHub stars
What to know before exploring
What it is
A static analysis security vulnerability scanner for Ruby on Rails applications
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year9 dated mentions
Observed mentions: 2012-03-05 22:09:34 UTC to 2020-02-05 11:02:29 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 2 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
9 sourcesBrakeman security scanner no longer open source
2 points · Open discussionSynopsys bought security scanner Brakeman and removed its open source license
3 points · Open discussionBrakeman Static Analysis Security Scanner Is Now Under Creative Commons License
2 points · Open discussionI think https://www.cybrary.it/ is pretty good for free lessons. You can combine it with VMs like https://www.offensive-security.com/metasploit-unleashed/requ... and those from https://www.vulnhub.com/ for a bit of hands-on. Also, you can get a lot of information specific to your language, like http://guides.rubyonrails.org/security.html and https://github.com/presidentbeef/brakeman to look at real apps, to see what can go wrong.
In Ask HN: Best route from developer to pentesterAbsolutely. It's all static analysis -- so we're pulling all the information we can out of the codebase without running the code. Under the hood, it's based on the Brakeman open source tool: https://github.com/presidentbeef/brakeman
It looks for all the big issues (XSS, CSRF, SQLi). In many cases it means keeping track of where user input enters the system (e.g. params) and how it is eventually used. So if you interpolate a param into a string and then give that string to ActiveRecord, it will produce a warning with high confidence you're vulnerable to SQL injection.
We run it every 2-3 hours on your repo, then look for new things that come up and send out alerts.
More info about Security Monitor is here: https://codeclimate.com/security-monitor
In Code Climate launches Security MonitorBrakeman is great. I think it should check the Gemfile also. Seems like a good place for it. The opinion is mixed though.
https://github.com/presidentbeef/brakeman/issues/276
A complementary command-line tool would be fine too.
In Don't find out about Ruby vulnerabilities through Hacker News and TwitterA couple that I know of which are based on the security side of things are Brakeman (https://github.com/presidentbeef/brakeman) and Scanny (https://github.com/openSUSE/scanny) on the open source side. On the commercial side I know Checkmarx covers rails (http://www.checkmarx.com/), amongst other languages
In John Carmack on Static Code AnalysisBrakeman: RoR Vulnerability Scanner
3 points · Open discussion