Brakeman

Brakeman is a SAST tool built for Ruby on Rails applications, free for non-commercial use under the Brakeman Public Use License. It scans Rails source code for 33 types of security vulnerabilities without ever running the application.

With 7,200+ GitHub stars, 154 contributors, and 54,100+ projects depending on it, Brakeman is the standard security scanner for the Rails ecosystem. OWASP lists Brakeman among its recommended Source Code Analysis Tools for Ruby on Rails. Organizations using it include Code Climate, GitHub, Groupon, New Relic, and Twitter. The latest release is v8.0.2 (February 2026).

What is Brakeman?

Brakeman performs static analysis on Ruby on Rails source code. You point it at a Rails app directory and it parses models, controllers, views, routes, and configuration files looking for security issues. It doesn’t need a running server or database, and you don’t have to install application dependencies first.

It understands Rails conventions, so it can trace data from params through controllers into views and detect when user input reaches a dangerous method without sanitization.

Key Features

Security checks

Brakeman detects 33 categories of security vulnerabilities, all specific to Rails patterns:

Confidence levels

Every finding gets a confidence rating:

• High — user input flows directly to a dangerous method
• Medium — a variable reaches a dangerous method but the input source is unclear
• Weak — indirect connection to user input

Filter by confidence on the command line: brakeman -w3 shows only high-confidence results, -w2 adds medium, -w1 shows everything.

False positive management

Brakeman ships an interactive ignore wizard:

brakeman -I

This walks through each warning and lets you mark false positives. Your decisions save to config/brakeman.ignore. On later scans, Brakeman automatically reads this file. Use brakeman --show-ignored to review ignored warnings without affecting the exit code.

Scan comparison

Compare two scan results to see what changed between builds:

# Generate a baseline
brakeman -o baseline.json

# Later, compare against it
brakeman --compare baseline.json

This shows new warnings, fixed warnings, and unchanged ones. Useful in CI to only flag issues introduced by a pull request.

Getting Started

Quick Docker scan

docker run -v "$(pwd)":/code presidentbeef/brakeman --color

Bundler setup

group :development do
  gem "brakeman", require: false
end

Then run with bundle exec brakeman.

When to Use Brakeman

Brakeman is purpose-built for Rails. If your app runs on Rails 2.3 through 8.x, it’s the most obvious choice for framework-aware security scanning.

Good use cases:

• Rails applications of any size, from side projects to large monoliths
• Pre-commit or CI checks that need to run fast without a database or server
• Adding Rails-specific depth alongside multi-language tools like Semgrep or SonarQube
• Teams that want to start with zero configuration and gradually tune with ignore files

Brakeman only analyzes Ruby on Rails code. If your project uses other frameworks (Sinatra, Hanami) or other languages, you’ll need a separate tool for those parts. It also does static analysis only, so it won’t catch vulnerabilities that only appear at runtime. For runtime coverage, pair it with an IAST or DAST tool.

Frequently Asked Questions