rubysec/bundler-audit

Health v2 · maintenance only

Adoption not part of the score

2756 stars · 250 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

bundler-audit is a command-line tool that audits a Ruby project's Gemfile.lock for gems with known vulnerabilities using the ruby-advisory-db. It also flags insecure gem sources and can update its advisory database locally.

Use cases

• scan Gemfile.lock for vulnerable gem versions
• check Ruby dependencies against a security advisory database
• find insecure http or git gem sources in a Bundler project
• run dependency security audits in CI without network access
• update the local ruby-advisory-db before auditing
• ignore advisories that have been manually worked around

When to choose

• you maintain a Ruby or Rails app using Bundler and want automated CVE checks
• you need an offline-capable dependency audit step in CI
• you want a lightweight CLI rather than a hosted scanning service

When to avoid

• your project does not use Bundler or Gemfile.lock
• you need scanning for non-Ruby ecosystems like npm or pip
• you want continuous runtime monitoring rather than point-in-time audits

Facets

cli-tool · maturity active

security dependency-audit cli security developer-tools version-control ruby cli cross-platform bundler rubygems ruby-advisory-db gemfile-lock vulnerability-scanning supply-chain-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rubysec/bundler-audit")