Skip to content
SPECIFICTION
Get listed

Brakeman

brakemanscanner.org

Free plan LinuxSelf-hosted
Visit brakemanscanner.org
Spec score 8.1 #5 of 21 in Ruby Static Analysis Tools

Spec sheet

Purpose
Brakeman is a static analysis scanner that checks Ruby on Rails application code for potential security vulnerabilities.Read 9 Oct 2026 · brakemanscanner.org
Support
The project links users to GitHub Discussions and Issues for community questions and bug reports.Read 9 Oct 2026 · brakemanscanner.org
Automation
Brakeman is designed for automated runs and documents integrations including Ruby LSP, Guard, Vim ALE, and Jenkins.Read 9 Oct 2026 · brakemanscanner.org
CI integrations
The project README also points to GitHub Actions and a Jenkins/Hudson plugin for continuous integration.Read 9 Oct 2026 · github.com
Compatibility
The project README says Brakeman should work with Rails 2.3.x through 8.x and requires Ruby 3.2.0 or later to run.Read 9 Oct 2026 · github.com
Confidence ratings
Warnings have High, Medium, or Weak confidence levels, which estimate how likely a warning is to represent a problem.Read 9 Oct 2026 · github.com
Detection coverage
The documented warning types include SQL injection, cross-site scripting, command injection, cross-site request forgery, path traversal, and unsafe deserialization.Read 9 Oct 2026 · brakemanscanner.org
False positives
The documentation cautions that Brakeman can produce false positives because it can only guess at the meaning of application code.Read 9 Oct 2026 · brakemanscanner.org
Install options
Brakeman can be installed as a Ruby gem, through Bundler, or using Docker.Read 9 Oct 2026 · brakemanscanner.org
Latest release
The homepage lists Brakeman 8.1.0, dated September 2026, with updates to SonarQube reporting and validation regex warnings.Read 9 Oct 2026 · brakemanscanner.org
Library use
Although designed as a command-line application, Brakeman can also be run as a Ruby library with Brakeman.run.Read 9 Oct 2026 · brakemanscanner.org
Performance option
The --faster option disables some features and may cause Brakeman to miss vulnerabilities.Read 9 Oct 2026 · github.com
Rails focus
It is built specifically for Rails and understands Rails patterns, conventions, and common vulnerability patterns.Read 9 Oct 2026 · brakemanscanner.org
Reports
It can output text, HTML, JSON, JUnit XML, and Markdown reports; JSON is recommended for automation.Read 9 Oct 2026 · brakemanscanner.org

Plans and prices

Brakeman Free Free vulnerability scanner for Ruby on Rails applications; GitHub README says free for non-commercial use Read 9 Oct 2026 · brakemanscanner.org

Every Brakeman plan and price →

Where Specifiction places it

Alternatives to BrakemanAll alternatives →