3 ms·
How is this better than brakeman? (http://brakemanscanner.org/ http://brakemanscanner.org/) Seems like they only pretty much check your gem dependencies while b
by param 14y ago
How is this better than brakeman? (http://brakemanscanner.org/ http://brakemanscanner.org/) Seems like they only pretty much check your gem dependencies while brakeman also does static code analysis and points out potential sql injection spots etc...
- re_todd 14y agoYeah, brakeman is awesome, here is a railscast for anyone interested: http://railscasts.com/episodes/358-brakeman http://railscasts.com/episodes/358-brakeman
- InAnEmergency 14y agoBrakeman will not check all gem dependencies and is not a general-purpose gem dependency security checker... bundler-audit will probably end up being the de facto tool for that: https://github.com/postmodern/bundler-audit https://github.com/postmodern/bundler-audit
- boonedocks 14y agoBrakeman is great. I think it should check the Gemfile also. Seems like a good place for it. The opinion is mixed though. https://github.com/presidentbeef/brakeman/issues/276 https://github.com/presidentbeef/brakeman/issues/276 A complementary command-line tool would be fine too.