Brakeman (Rails)

brakeman -A

Scans the Rails application with Brakeman, detecting framework-specific vulnerabilities (SQLi, XSS, CSRF, mass assignment).

Run it in the Rails project pipeline when you want static analysis of the framework: brakeman analyzes the application (controllers, views, models) and reports findings with severity and line — SQL injection, XSS, CSRF, mass assignment, open redirects — with Rails-specific warnings. It's the reference SAST for Rails: framework vulnerability analysis that generic SAST tools don't cover. In Rails DevSecOps, brakeman is the pipeline piece: high-severity findings block the merge.

Don't use it for non-Rails languages: brakeman analyzes Rails (Ruby) apps — the rest of the code is covered by language-specific SAST. And watch out: brakeman detects framework-rule vulnerabilities — logic ones (authorization, business) require manual analysis; and findings are triaged (false positives, with brakeman.ignore). Keep the version up to date (new warnings from Rails versions). Static analysis complements DAST (the app at runtime).