3 ms·
This is a really useful service for what we call "version tracking," and it looks like it's running Brakeman for you too. With that said, it won't find vulnerab
by borski 13y ago
This is a really useful service for what we call "version tracking," and it looks like it's running Brakeman for you too. With that said, it won't find vulnerabilities you code in yourself - only publicly released vulns that Ruby, etc. have issued patches for. A tool like https://www.tinfoilsecurity.com https://www.tinfoilsecurity.com can help you find more vulnerabilities that either a) haven't been found yet publicly or b) you've written in yourself. (Disclosure: I'm the cofounder)
- vasinov 13y ago"With that said, it won't find vulnerabilities you code in yourself - only publicly released vulns that Ruby, etc. have issued patches for." This is not quite true. Brakeman (and Hakiri for that matter) runs static code analysis and finds vulnerabilities that were introduced by the developer. E.g., XSS, SQL injection, etc.
- borski 13y agoYou're right - I took away too much credit by saying that. However, brakeman had its own issues (tons of false positives, etc.). It's a great project but too complex / cries wolf too often for a lot of projects. Dynamic analysis has issues too, but it often finds more than brakeman (or any purely static code analysis tool).
- InAnEmergency 13y agoDefinitely running Brakeman, as are https://codeclimate.com/ https://codeclimate.com/, https://www.pullreview.com https://www.pullreview.com and http://rails-brakeman.com/ http://rails-brakeman.com/.
- borski 13y agoYup! Nothing wrong with that - just wanted to make sure it was clear what was going on. I run brakeman fairly often on my own for my projects. :)