# presidentbeef/brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications

Repository: https://github.com/presidentbeef/brakeman
Canonical: https://ross.abutalabs.com/products/brakeman
Homepage: https://brakemanscanner.org/
Language: Ruby
License: NOASSERTION
License Family: other
Topics: ruby, rails, security, static-analysis, vulnerabilities, brakeman, security-vulnerability, security-tools, security-audit
Last push: 2026-08-13T17:08:16+00:00

## Health v2 (maintenance only)
Score: 93/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 97, release rhythm 85, longevity 100
- inputs: {"age_days": 5851, "days_push": 20, "days_rel": 21, "gap_med": 66.5, "n_releases_24m": 13}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 7262, forks 776 (observed 2026-08-28T04:09:57.885807+00:00)

## What it is
Brakeman is a free, open-source static analysis security scanner built specifically for Ruby on Rails applications. It analyzes Rails source code without running it to detect vulnerabilities like SQL injection, XSS, and command injection, producing reports in many formats.

## Use cases
- scan a Rails app for security vulnerabilities
- find SQL injection in Ruby on Rails code
- detect XSS vulnerabilities in Rails controllers and views
- run security checks in CI for a Rails project
- audit Rails code without executing it
- generate SARIF or JSON security reports from Rails scans

## When to choose
- you have a Ruby on Rails application (2.3 through 8.x) and want zero-configuration security scanning
- you need fast static analysis that runs locally or in CI without executing the app
- you want Rails-specific vulnerability checks that generic SAST tools miss

## When to avoid
- your project is not a Rails application (use a general-purpose SAST tool instead)
- you need dynamic or runtime security testing rather than static analysis
- you need to scan non-Ruby code

## Facets
- artifact type: cli-tool
- maturity: stable
- function: security, vulnerability-scanning, static-site-generator, developer-tools, cli
- domain: security, web-development, developer-tools, backend
- platform: ruby, cli, cross-platform
- tags: static-analysis, sast, ruby-on-rails, security-audit, code-scanning, docker

## Member repositories
- presidentbeef/brakeman (main) score 93

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:57.885807+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:38:56.875768+00:00, confidence not recorded.
  - readme: https://github.com/presidentbeef/brakeman (fetched 2026-08-28T04:09:57.885807+00:00, sha 88122ee6b1b0)
  - homepage: https://brakemanscanner.org/ (fetched 2026-08-29T08:34:26.120881+00:00, sha ffefb93f1aee)
  - site_page: https://brakemanscanner.org/docs (fetched 2026-08-29T08:34:26.130161+00:00, sha db1ba3103caf)
  - site_page: https://brakemanscanner.org/docs/quickstart (fetched 2026-08-29T08:34:26.132155+00:00, sha 8602867f618e)
- Data as of 2026-08-30T08:39:29.467469+00:00.