Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?

share|improve this question
up vote 7 down vote accepted

Yes. You want Brakeman, a tool that scans your RoR code for security vulnerabilities

I recommend reading the OWASP Ruby on Rails Security Guide.

You could also try any web pen-testing tool; they are not language-specific. There are many of them. They only find low-hanging fruit, not all security problems, but it can't hurt to use them just in case they find anything your other methods missed. Search on this forum to find more information, e.g., What tools are available to assess the security of a web application?.

share|improve this answer

Disclaimer: I'm the gem author.

I wrote Codesake::Dawn, a security source code scanner for ruby code. I'm close to release version 1.1.0 with 171 security checks (CVE bulletins and Owasp ROR cheatsheet) included. It works with Sinatra, Padrino and Rails web application out of the box.

It doesn't detect xss introduced in your code... yet :-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.