Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Yes. You want Brakeman, a tool that scans your RoR code for security vulnerabilities

I recommend reading the OWASP Ruby on Rails Security Guide.

You could also try any web pen-testing tool; they are not language-specific. There are many of them. They only find low-hanging fruit, not all security problems, but it can't hurt to use them just in case they find anything your other methods missed. Search on this forum to find more information, e.g., What tools are available to assess the security of a web application?.

share|improve this answer

Disclaimer: I'm the gem author.

I wrote Codesake::Dawn, a security source code scanner for ruby code. I'm close to release version 1.1.0 with 171 security checks (CVE bulletins and Owasp ROR cheatsheet) included. It works with Sinatra, Padrino and Rails web application out of the box.

It doesn't detect xss introduced in your code... yet :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.