https://github.com/presidentbeef/brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications
https://github.com/presidentbeef/brakeman

Keywords

brakeman rails ruby security security-audit security-tools security-vulnerability static-analysis vulnerabilities

Keywords from Contributors

activerecord activejob mvc rubygem rubocop rspec code-formatter static-code-analysis sinatra crash-reporting

Last synced: about 8 hours ago
JSON representation

Repository metadata

A static analysis security vulnerability scanner for Ruby on Rails applications

Host: GitHub
URL: https://github.com/presidentbeef/brakeman
Owner: presidentbeef
License: other
Created: 2010-08-27T00:00:58.000Z (over 15 years ago)
Default Branch: main
Last Pushed: 2025-12-02T21:20:58.000Z (7 days ago)
Last Synced: 2025-12-05T19:50:46.787Z (5 days ago)
Topics: brakeman, rails, ruby, security, security-audit, security-tools, security-vulnerability, static-analysis, vulnerabilities
Language: Ruby
Homepage: https://brakemanscanner.org/
Size: 42.3 MB
Stars: 7,165
Watchers: 159
Forks: 761
Open Issues: 121
Releases: 150
Metadata Files:
- Readme: README.md
- Changelog: CHANGES.md
- Contributing: CONTRIBUTING.md
- License: COPYING.md
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md

Brakeman

Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities.

Installation

Using RubyGems:

gem install brakeman

Using Bundler:

group :development do
  gem 'brakeman', require: false
end

Using Docker:

docker pull presidentbeef/brakeman

Using Docker to build from source:

git clone https://github.com/presidentbeef/brakeman.git
cd brakeman
docker build . -t brakeman

Usage

Running locally

From a Rails application's root directory:

brakeman

Outside of Rails root:

brakeman /path/to/rails/application

Running with Docker

From a Rails application's root directory:

docker run -v "$(pwd)":/code presidentbeef/brakeman

With a little nicer color:

docker run -v "$(pwd)":/code presidentbeef/brakeman --color

For an HTML report:

docker run -v "$(pwd)":/code presidentbeef/brakeman -o brakeman_results.html

Outside of Rails root (note that the output file is relative to path/to/rails/application):

docker run -v 'path/to/rails/application':/code presidentbeef/brakeman -o brakeman_results.html

Compatibility

Brakeman should work with any version of Rails from 2.3.x to 8.x.

Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.

Basic Options

For a full list of options, use brakeman --help or see the OPTIONS.md file.

To specify an output file for the results:

brakeman -o output_file

The output format is determined by the file extension or by using the -f option. Current options are: text, html, tabs, json, junit, markdown, csv, codeclimate, and sonar.

Multiple output files can be specified:

brakeman -o output.html -o output.json

To output to both a file and to the console, with color:

brakeman --color -o /dev/stdout -o output.json

To suppress informational warnings and just output the report:

brakeman -q

Note all Brakeman output except reports are sent to stderr, making it simple to redirect stdout to a file and just get the report.

To see all kinds of debugging information:

brakeman -d

Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):

brakeman -x DefaultRoutes

Multiple checks should be separated by a comma:

brakeman -x DefaultRoutes,Redirect

To do the opposite and only run a certain set of tests:

brakeman -t SQL,ValidationRegex

If Brakeman is running a bit slow, try

brakeman --faster

This will disable some features, but will probably be much faster (currently it is the same as --skip-libs --no-branching). WARNING: This may cause Brakeman to miss some vulnerabilities.

By default, Brakeman will return a non-zero exit code if any security warnings are found or scanning errors are encountered. To disable this:

brakeman --no-exit-on-warn --no-exit-on-error

To skip certain files or directories that Brakeman may have trouble parsing, use:

brakeman --skip-files file1,/path1/,path2/

To compare results of a scan with a previous scan, use the JSON output option and then:

brakeman --compare old_report.json

This will output JSON with two lists: one of fixed warnings and one of new warnings.

Brakeman will ignore warnings if configured to do so. By default, it looks for a configuration file in config/brakeman.ignore.
To create and manage this file, use:

brakeman -I

If you want to temporarily see the warnings you ignored without affecting the exit code, use:

brakeman --show-ignored

Warning information

See warning_types for more information on the warnings reported by this tool.

Warning context

The HTML output format provides an excerpt from the original application source where a warning was triggered. Due to the processing done while looking for vulnerabilities, the source may not resemble the reported warning and reported line numbers may be slightly off. However, the context still provides a quick look into the code which raised the warning.

Confidence levels

Brakeman assigns a confidence level to each warning. This provides a rough estimate of how certain the tool is that a given warning is actually a problem. Naturally, these ratings should not be taken as absolute truth.

There are three levels of confidence:

High - Either this is a simple warning (boolean value) or user input is very likely being used in unsafe ways.
Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
Weak - Typically means user input was indirectly used in a potentially unsafe manner.

To only get warnings above a given confidence level:

brakeman -w3

The -w switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only highest confidence warnings).

Configuration files

Brakeman options can be stored and read from YAML files.

To simplify the process of writing a configuration file, the -C option will output the currently set options:

$ brakeman -C --skip-files plugins/
---
:skip_files:
- plugins/

Options passed in on the commandline have priority over configuration files.

The default config locations are ./config/brakeman.yml, ~/.brakeman/config.yml, and /etc/brakeman/config.yml

The -c option can be used to specify a configuration file to use.

Continuous Integration

There is a plugin available for Jenkins/Hudson.

For even more continuous testing, try the Guard plugin.

There are a couple GitHub Actions available.

Building

git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman*.gem

Who is Using Brakeman?

..and more!

Homepage/News

Website: http://brakemanscanner.org/

Twitter: https://twitter.com/brakeman

Chat: https://gitter.im/presidentbeef/brakeman

License

Brakeman is free for non-commercial use.

See COPYING for details.

Owner metadata

Name: Justin Collins
Login: presidentbeef
Email:
Kind: user
Description: I work on Brakeman and do security stuff.
Website: https://presidentbeef.com
Location: Canada
Twitter:
Company:
Icon url: https://avatars.githubusercontent.com/u/75613?u=ce662367116d8d32164b77a6812b38e952cd684b&v=4
Repositories: 85
Last ynced at: 2025-10-10T10:56:57.135Z
Profile URL: https://github.com/presidentbeef

GitHub Events

Total

Create event: 30
Release event: 5
Issues event: 60
Watch event: 171
Delete event: 28
Issue comment event: 157
Push event: 97
Pull request review event: 4
Pull request review comment event: 5
Pull request event: 79
Fork event: 27

Last Year

Create event: 25
Release event: 4
Issues event: 51
Watch event: 138
Delete event: 25
Issue comment event: 130
Push event: 87
Pull request review event: 4
Pull request review comment event: 5
Pull request event: 65
Fork event: 21

Committers metadata

Last synced: 4 days ago

Total Commits: 3,054
Total Committers: 181
Avg Commits per committer: 16.873
Development Distribution Score (DDS): 0.38

Commits in past year: 78
Committers in past year: 15
Avg Commits per committer in past year: 5.2
Development Distribution Score (DDS) in past year: 0.333

Name	Email	Commits
Justin Collins	j**n@p**m	1894
Justin Collins	j**s@a**m	423
Justin Collins	j**n@s**m	152
Justin Collins	c**s@t**m	126
oreoshake	n**l@g**m	59
Patrick Toomey	p**3@b**m	24
Bart ten Brinke	i**o@r**m	11
Mastahyeti	m****i	10
Andy Waite	g**w@a**m	10
soffolk	l**u@e**y	9
bethanyr	b**z@h**m	9
Jacob Evelyn	j**n@p**m	9
Esty Scheiner	s**1@g**m	9
themetric	m**p@g**m	8
David Lanner	d**r@p**m	8
Jason Yeo	j**8@g**m	7
Dave Worth	d**e@h**m	7
Gabriel Arcangel Zayas	g**s@h**m	6
Philippe Bernery	p**e@b**r	6
Noah Davis	n**1@y**m	6
Nick	n**n@t**m	6
grosser	g**l@g**m	6
Neil Matatall	n**m@t**m	5
Will Fleming	w**l@f**g	5
Mastahyeti	m**i@g**m	5
Eli Block	3****k	5
fsword	l**e@g**m	4
Jeff Rafter	j**r@g**m	4
Geoffrey Hichborn	g**f@s**m	4
Bryan Helmkamp	b**n@b**m	4
and 151 more...

Committer domains:

Issue and Pull Request metadata

Last synced: 3 days ago

Total issues: 150
Total pull requests: 215
Average time to close issues: 6 months
Average time to close pull requests: 28 days
Total issue authors: 134
Total pull request authors: 55
Average comments per issue: 1.98
Average comments per pull request: 1.51
Merged pull request: 168
Bot issues: 0
Bot pull requests: 0

Past year issues: 38
Past year pull requests: 78
Past year average time to close issues: about 1 month
Past year average time to close pull requests: 22 days
Past year issue authors: 34
Past year pull request authors: 21
Past year average comments per issue: 1.39
Past year average comments per pull request: 1.42
Past year merged pull request: 58
Past year bot issues: 0
Past year bot pull requests: 0

More stats: https://issues.ecosyste.ms/repositories/lookup?url=https://github.com/presidentbeef/brakeman

Top Issue Authors

kwerle (5)
presidentbeef (3)
dgholz (3)
gavingmiller (2)
chaadow (2)
gstokkink (2)
akimd (2)
rbclark (2)
dawidof (2)
bdewater (2)
pbernery (2)
borisk47 (1)
fwolfst (1)
RTBear (1)
greendrop (1)

Top Pull Request Authors

presidentbeef (124)
tobyhs (6)
gazayas (6)
chaadow (4)
Earlopain (4)
casperisfine (3)
viralpraxis (3)
kwerle (3)
patbl (2)
jamgregory (2)
lubert (2)
pbernery (2)
Catsuko (2)
ron-shinall (2)
JasonnnW3000 (2)

Top Issue Labels

help wanted (2)
false positive (1)

Top Pull Request Labels

Package metadata

Total packages: 7
Total downloads:
- rubygems: 373,330,697 total
Total docker downloads: 402,350,328
Total dependent packages: 119 (may contain duplicates)
Total dependent repositories: 9,060 (may contain duplicates)
Total versions: 819
Total maintainers: 1

gem.coop: brakeman

Brakeman detects security vulnerabilities in Ruby on Rails applications via static analysis.

Homepage: https://brakemanscanner.org/
Documentation: http://www.rubydoc.info/gems/brakeman/
Licenses: Brakeman Public Use License
Latest release: 7.1.1 (published about 1 month ago)
Last Synced: 2025-12-06T00:02:43.055Z (4 days ago)
Versions: 160
Dependent Packages: 0
Dependent Repositories: 0
Downloads: 186,128,745 Total
Docker Downloads: 201,175,164
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 0.045%
- Downloads: 0.134%
Maintainers (1)
- presidentbeef

rubygems.org: brakeman

Brakeman detects security vulnerabilities in Ruby on Rails applications via static analysis.

Homepage: https://brakemanscanner.org/
Documentation: http://www.rubydoc.info/gems/brakeman/
Licenses: Brakeman Public Use License
Latest release: 7.1.1 (published about 1 month ago)
Last Synced: 2025-12-06T22:00:55.585Z (3 days ago)
Versions: 160
Dependent Packages: 119
Dependent Repositories: 9,050
Downloads: 186,168,062 Total
Docker Downloads: 201,175,164
Rankings:
- Downloads: 0.145%
- Stargazers count: 0.17%
- Dependent packages count: 0.294%
- Dependent repos count: 0.345%
- Average: 0.395%
- Docker downloads count: 0.588%
- Forks count: 0.826%
Maintainers (1)
- presidentbeef

gem.coop: brakeman-min

Brakeman detects security vulnerabilities in Ruby on Rails applications via static analysis. This version of the gem only requires the minimum number of dependencies. Use the 'brakeman' gem for a full install.

Homepage: https://brakemanscanner.org/
Documentation: http://www.rubydoc.info/gems/brakeman-min/
Licenses: Brakeman Public Use License
Latest release: 7.1.1 (published about 1 month ago)
Last Synced: 2025-12-06T03:00:23.766Z (4 days ago)
Versions: 109
Dependent Packages: 0
Dependent Repositories: 0
Downloads: 361,251 Total
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.625%
- Downloads: 4.876%
Maintainers (1)
- presidentbeef

gem.coop: brakeman-lib

Brakeman detects security vulnerabilities in Ruby on Rails applications via static analysis. This package declares gem dependencies instead of bundling them.

Homepage: https://brakemanscanner.org/
Documentation: http://www.rubydoc.info/gems/brakeman-lib/
Licenses: Brakeman Public Use License
Latest release: 7.1.1 (published about 1 month ago)
Last Synced: 2025-12-04T22:03:35.903Z (5 days ago)
Versions: 66
Dependent Packages: 0
Dependent Repositories: 0
Downloads: 155,827 Total
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 2.447%
- Downloads: 7.341%
Maintainers (1)
- presidentbeef

proxy.golang.org: github.com/presidentbeef/brakeman

Homepage:
Documentation: https://pkg.go.dev/github.com/presidentbeef/brakeman#section-documentation
Licenses: other
Latest release: v7.1.1+incompatible (published about 1 month ago)
Last Synced: 2025-12-04T22:03:35.720Z (5 days ago)
Versions: 149
Dependent Packages: 0
Dependent Repositories: 1
Rankings:
- Stargazers count: 0.811%
- Forks count: 1.072%
- Average: 3.782%
- Dependent repos count: 4.794%
- Dependent packages count: 8.453%

rubygems.org: brakeman-min

Homepage: https://brakemanscanner.org/
Documentation: http://www.rubydoc.info/gems/brakeman-min/
Licenses: Brakeman Public Use License
Latest release: 7.1.1 (published about 1 month ago)
Last Synced: 2025-12-04T22:03:36.622Z (5 days ago)
Versions: 109
Dependent Packages: 0
Dependent Repositories: 6
Downloads: 360,985 Total
Rankings:
- Stargazers count: 0.172%
- Forks count: 0.8%
- Downloads: 4.409%
- Average: 6.017%
- Dependent repos count: 9.128%
- Dependent packages count: 15.575%
Maintainers (1)
- presidentbeef

rubygems.org: brakeman-lib

Brakeman detects security vulnerabilities in Ruby on Rails applications via static analysis. This package declares gem dependencies instead of bundling them.

Homepage: https://brakemanscanner.org/
Documentation: http://www.rubydoc.info/gems/brakeman-lib/
Licenses: Brakeman Public Use License
Latest release: 7.1.1 (published about 1 month ago)
Last Synced: 2025-12-04T22:03:36.101Z (5 days ago)
Versions: 66
Dependent Packages: 0
Dependent Repositories: 3
Downloads: 155,827 Total
Rankings:
- Stargazers count: 0.172%
- Forks count: 0.8%
- Average: 7.615%
- Downloads: 8.829%
- Dependent repos count: 12.698%
- Dependent packages count: 15.575%
Maintainers (1)
- presidentbeef

Dependencies

.github/workflows/docker-hub-push.yml actions

actions/checkout v3 composite
docker/build-push-action v3 composite
docker/login-action v2 composite
docker/setup-buildx-action v2 composite
docker/setup-qemu-action v2 composite

Dockerfile docker

ruby 2.7-alpine build

test/apps/rails6/package.json npm

webpack-dev-server ^3.2.1 development
@rails/actioncable ^6.0.0-alpha
@rails/activestorage ^6.0.0-alpha
@rails/ujs ^6.0.0-alpha
@rails/webpacker ^4.0.2
turbolinks ^5.2.0

test/apps/rails6/yarn.lock npm

935 dependencies

Gemfile rubygems

rake >= 0

test/apps/active_record_only/Gemfile rubygems

activerecord ~> 5.2.4.3

test/apps/rails3/Gemfile rubygems

rails = 3.0.3
sqlite3 >= 0

test/apps/rails3/Gemfile.lock rubygems

abstract 1.0.0
actionmailer 3.0.3
actionpack 3.0.3
activemodel 3.0.3
activerecord 3.0.3
activeresource 3.0.3
activesupport 3.0.3
arel 2.0.10
builder 2.1.2
erubis 2.6.6
i18n 0.6.0
json_pure 1.6.4
mail 2.2.19
mime-types 1.16
polyglot 0.3.2
rack 1.2.3
rack-mount 0.6.14
rack-test 0.5.7
rails 3.0.3
railties 3.0.3
rake 0.9.2
sqlite3 1.3.3
thor 0.14.6
treetop 1.4.10
tzinfo 0.3.29

test/apps/rails3.1/Gemfile rubygems

coffee-rails ~> 3.1.0 development
sass-rails ~> 3.1.0 development
uglifier >= 0 development
draper >= 0
jquery-rails >= 0
json >= 0
mysql >= 0
rails = 3.1.0
therubyracer >= 0

test/apps/rails3.1/Gemfile.lock rubygems

actionmailer 3.1.0
actionpack 3.1.0
activemodel 3.1.0
activerecord 3.1.0
activeresource 3.1.0
activesupport 3.1.0
arel 2.2.1
bcrypt-ruby 3.0.0
builder 3.0.0
coffee-rails 3.1.0
coffee-script 2.2.0
coffee-script-source 1.1.2
erubis 2.7.0
execjs 1.2.4
hike 1.2.1
i18n 0.6.0
jquery-rails 1.0.13
json 1.5.4
libv8 3.3.10.2
mail 2.3.0
mime-types 1.16
multi_json 1.0.3
mysql 2.9.1
polyglot 0.3.2
rack 1.3.2
rack-cache 1.0.3
rack-mount 0.8.3
rack-ssl 1.3.2
rack-test 0.6.1
rails 3.1.0
railties 3.1.0
rake 0.9.2
rdoc 3.9.4
sass 3.1.7
sass-rails 3.1.0
sprockets 2.0.0
therubyracer 0.9.4
thor 0.14.6
tilt 1.3.3
treetop 1.4.10
tzinfo 0.3.29
uglifier 1.0.3

test/apps/rails3.2/Gemfile rubygems

coffee-rails ~> 3.2.1 development
sass-rails ~> 3.2.3 development
uglifier >= 1.0.3 development
jquery-rails >= 0
json >= 0
rails = 3.2.9.rc2
sqlite3 >= 0

test/apps/rails3.2/Gemfile.lock rubygems

actionmailer 3.2.9.rc2
actionpack 3.2.9.rc2
activemodel 3.2.9.rc2
activerecord 3.2.9.rc2
activeresource 3.2.9.rc2
activesupport 3.2.9.rc2
arel 3.0.2
builder 3.0.3
coffee-rails 3.2.2
coffee-script 2.2.0
coffee-script-source 1.3.3
erubis 2.7.0
execjs 1.4.0
hike 1.2.1
i18n 0.6.1
journey 1.0.4
jquery-rails 2.1.2
json 1.7.5
mail 2.4.4
mime-types 1.19
multi_json 1.3.6
polyglot 0.3.3
rack 1.4.1
rack-cache 1.2
rack-ssl 1.3.2
rack-test 0.6.1
rails 3.2.9.rc2
railties 3.2.9.rc2
rake 0.9.2.2
rdoc 3.12
sass 3.2.1
sass-rails 3.2.5
sprockets 2.1.3
sqlite3 1.3.6
thor 0.16.0
tilt 1.3.3
treetop 1.4.10
tzinfo 0.3.33
uglifier 1.3.0

test/apps/rails4/Gemfile rubygems

coffee-rails ~> 4.0.0 development
sass-rails ~> 4.0.0 development
uglifier >= 1.0.3 development
haml >= 0
jbuilder ~> 1.0.1
jquery-rails >= 0
pg >= 0
rails = 4.0.0
turbolinks >= 0

test/apps/rails4_non_standard_structure/rails4test.gemspec rubygems

haml >= 0
rails >= 4.1.8

test/apps/rails4_with_engines/gems.rb rubygems

coffee-rails ~> 4.0.0 development
sass-rails ~> 4.0.0 development
uglifier >= 1.0.3 development
jbuilder ~> 1.0.1
jquery-rails >= 0
rails = 4.0.0
sqlite3 >= 0
turbolinks >= 0

test/apps/rails5/Gemfile rubygems

byebug >= 0 development
spring >= 0 development
web-console ~> 3.0 development
actionpack-page_caching = 1.2.0
coffee-rails ~> 4.1.0
jbuilder ~> 2.0
jquery-rails >= 0
puma >= 0
rails >= 5.0.0.beta1, < 5.1
sqlite3 >= 0
turbolinks >= 0
tzinfo-data >= 0
uglifier >= 1.3.0

test/apps/rails5/Gemfile.lock rubygems

actioncable 5.0.0
actionmailer 5.0.0
actionpack 5.0.0
actionview 5.0.0
activejob 5.0.0
activemodel 5.0.0
activerecord 5.0.0
activesupport 5.0.0
arel 7.0.0
builder 3.2.2
byebug 8.2.1
celluloid 0.17.2
celluloid-essentials 0.20.5
celluloid-extras 0.20.5
celluloid-fsm 0.20.5
celluloid-pool 0.20.5
celluloid-supervision 0.20.5
coffee-rails 4.1.1
coffee-script 2.4.1
coffee-script-source 1.10.0
concurrent-ruby 1.0.0
debug_inspector 0.0.2
em-hiredis 0.3.0
erubis 2.7.0
eventmachine 1.0.9.1
execjs 2.6.0
faye-websocket 0.10.2
globalid 0.3.6
hiredis 0.5.2
hitimes 1.2.3
i18n 0.7.0
jbuilder 2.4.0
jquery-rails 4.1.0
json 1.8.3
loofah 2.0.3
mail 2.6.3
method_source 0.8.2
mime-types 2.99
mini_portile2 2.0.0
minitest 5.8.3
multi_json 1.11.2
nokogiri 1.6.7.1
puma 2.15.3
rack 2.0.0.alpha
rack-test 0.6.3
rails 5.0.0
rails-deprecated_sanitizer 1.0.3
rails-dom-testing 1.0.7
rails-html-sanitizer 1.0.2
railties 5.0.0
rake 10.5.0
redis 3.2.2
spring 1.6.2
sprockets 3.5.2
sprockets-rails 3.0.0
sqlite3 1.3.11
thor 0.19.1
thread_safe 0.3.5
timers 4.1.1
turbolinks 2.5.3
tzinfo 1.2.2
uglifier 2.7.2
web-console 3.0.0
websocket-driver 0.6.3
websocket-extensions 0.1.2

test/apps/rails5.2/Gemfile rubygems

byebug >= 0 development
capybara ~> 2.15 development
chromedriver-helper >= 0 development
listen >= 3.0.5, < 3.2 development
selenium-webdriver >= 0 development
spring >= 0 development
spring-watcher-listen ~> 2.0.0 development
web-console >= 3.3.0 development
bootsnap >= 1.1.0
coffee-rails ~> 4.2
haml ~> 5.0.3
jbuilder ~> 2.5
puma ~> 3.11
rails ~> 5.2.0.beta2
sass-rails ~> 5.0
slim ~> 3.0.1
sqlite3 >= 0
turbolinks ~> 5
tzinfo-data >= 0
uglifier >= 1.3.0

test/apps/rails5.2/Gemfile.lock rubygems

actioncable 5.2.0.beta2
actionmailer 5.2.0.beta2
actionpack 5.2.0.beta2
actionview 5.2.0.beta2
activejob 5.2.0.beta2
activemodel 5.2.0.beta2
activerecord 5.2.0.beta2
activestorage 5.2.0.beta2
activesupport 5.2.0.beta2
addressable 2.5.2
archive-zip 0.7.0
arel 9.0.0
bindex 0.5.0
bootsnap 1.1.5
builder 3.2.3
byebug 9.1.0
capybara 2.16.1
childprocess 0.8.0
chromedriver-helper 1.1.0
coffee-rails 4.2.2
coffee-script 2.4.1
coffee-script-source 1.12.2
concurrent-ruby 1.0.5
crass 1.0.3
erubi 1.7.0
execjs 2.7.0
ffi 1.9.18
globalid 0.4.1
i18n 0.9.1
io-like 0.3.0
jbuilder 2.7.0
listen 3.1.5
loofah 2.1.1
mail 2.7.0
method_source 0.9.0
mini_mime 1.0.0
mini_portile2 2.3.0
minitest 5.10.3
msgpack 1.2.0
multi_json 1.12.2
nio4r 2.1.0
nokogiri 1.8.1
public_suffix 3.0.1
puma 3.11.0
rack 2.0.3
rack-test 0.8.2
rails 5.2.0.beta2
rails-dom-testing 2.0.3
rails-html-sanitizer 1.0.3
railties 5.2.0.beta2
rake 12.3.0
rb-fsevent 0.10.2
rb-inotify 0.9.10
ruby_dep 1.5.0
rubyzip 1.2.1
sass 3.5.3
sass-listen 4.0.0
sass-rails 5.0.7
selenium-webdriver 3.8.0
spring 2.0.2
spring-watcher-listen 2.0.1
sprockets 3.7.1
sprockets-rails 3.2.1
sqlite3 1.3.13
thor 0.20.0
thread_safe 0.3.6
tilt 2.0.8
turbolinks 5.0.1
turbolinks-source 5.0.3
tzinfo 1.2.4
uglifier 4.0.1
web-console 3.5.1
websocket-driver 0.6.5
websocket-extensions 0.1.3
xpath 2.1.0

test/apps/rails6/Gemfile rubygems

byebug >= 0 development
capybara >= 2.15 development
chromedriver-helper >= 0 development
listen >= 3.0.5, < 3.2 development
selenium-webdriver >= 0 development
spring >= 0 development
spring-watcher-listen ~> 2.0.0 development
web-console >= 3.3.0 development
bootsnap >= 1.4.1
jbuilder ~> 2.5
puma ~> 3.11
rails ~> 6.0.0.beta2
safe_yaml >= 0
sass-rails ~> 5.0
sqlite3 ~> 1.3, >= 1.3.6
turbolinks ~> 5
tzinfo-data >= 0
webpacker >= 4.0.0.rc.3

test/apps/rails7/Gemfile rubygems

capybara >= 3.26 development
selenium-webdriver >= 4.0.0 development
web-console >= 4.1.0 development
webdrivers >= 0 development
bootsnap >= 1.4.4
importmap-rails >= 0.9.2
jbuilder ~> 2.11
puma ~> 5.0
rails ~> 7.0.0
sprockets-rails >= 3.4.1
sqlite3 ~> 1.4
stimulus-rails >= 0.7.3
turbo-rails >= 0.9.0

test/apps/rails7/Gemfile.lock rubygems

actioncable 7.0.4
actionmailbox 7.0.4
actionmailer 7.0.4
actionpack 7.0.4
actiontext 7.0.4
actionview 7.0.4
activejob 7.0.4
activemodel 7.0.4
activerecord 7.0.4
activestorage 7.0.4
activesupport 7.0.4
addressable 2.8.0
bindex 0.8.1
bootsnap 1.9.3
builder 3.2.4
capybara 3.36.0
childprocess 4.1.0
concurrent-ruby 1.1.10
crass 1.0.6
debug 1.3.4
digest 3.1.0
erubi 1.11.0
globalid 1.0.0
i18n 1.12.0
importmap-rails 0.9.3
io-console 0.5.9
irb 1.3.7
jbuilder 2.11.3
loofah 2.19.0
mail 2.7.1
marcel 1.0.2
matrix 0.4.2
method_source 1.0.0
mini_mime 1.1.2
mini_portile2 2.8.0
minitest 5.16.3
msgpack 1.4.2
net-imap 0.2.3
net-pop 0.1.1
net-protocol 0.1.3
net-smtp 0.3.1
nio4r 2.5.8
nokogiri 1.13.8
public_suffix 4.0.6
puma 5.5.2
racc 1.6.0
rack 2.2.4
rack-test 2.0.2
rails 7.0.4
rails-dom-testing 2.0.3
rails-html-sanitizer 1.4.2
railties 7.0.4
rake 13.0.6
regexp_parser 2.2.0
reline 0.2.7
rexml 3.2.5
rubyzip 2.3.2
selenium-webdriver 4.1.0
sprockets 4.0.2
sprockets-rails 3.4.1
sqlite3 1.4.2
stimulus-rails 0.7.3
strscan 3.0.4
thor 1.2.1
timeout 0.3.0
turbo-rails 0.9.0
tzinfo 2.0.5
web-console 4.2.0
webdrivers 5.0.0
websocket-driver 0.7.5
websocket-extensions 0.1.5
xpath 3.2.0
zeitwerk 2.6.0

test/apps/rails_with_xss_plugin/Gemfile rubygems

json = 1.1.0
rails = 2.3.14
sqlite3 >= 0

test/apps/rails5.2/package.json npm

brakeman-lib.gemspec rubygems

brakeman-min.gemspec rubygems

brakeman.gemspec rubygems

Score: 34.561471495957036