Security audits: Brakeman
This course runs Brakeman, a static analyzer for Rails, against a real report from this repository. The report held six warnings: three format-validation warnings about regex anchors and three possible SQL injections in a search query. Each one is triaged by tracing where values come from and whether the safety is local to the code. The lessons separate confidence from severity and cover running Brakeman in CI with baselines and ignore files. They also list what scanners cannot find and close with a security workflow combining tools and human review.
What you'll learn
- ✓How Brakeman tracks untrusted data from sources to dangerous sinks
- ✓Why Ruby validation regexes need \A and \z anchors
- ✓A four-question method for triaging SQL-injection warnings
- ✓The difference between a warning's confidence and its severity
- ✓Running Brakeman in CI with baselines and documented ignore files
- ✓Which security problems need human review because no scanner finds them
Running Brakeman on this repository
The previous course ended with an audit and a list of things a person has to look for. Brakeman is the part of that list a program can do: it reads your Rails source, follows data from user input to dangerous method calls, and reports what it finds.
Read the full lesson free →Curriculum
7 lessonsRunning Brakeman on this repository
Runs Brakeman on this repository and explains static analysis, sources and sinks, confidence levels, and its limits.
The format-validation warnings
Explains why a URL regex without \z accepts text after a newline, and extracts the fix into one policy object.
The SQL-injection warnings
Traces three values in a search query's SQL, finds the warnings unexploitable, and replaces interpolation with literal fragments.
Confidence, and triage
Separates confidence from severity and gives four triage questions with three outcomes: fix, ignore with reason, or accept.
Living with it: CI and baselines
Covers running Brakeman in CI, reaching zero warnings, baselines with noted ignore entries, and useful command flags.
Beyond Brakeman
Compares Brakeman with other security tools and lists the flaws only human review can catch, such as missing authorization.
Putting it together: a security workflow
Resolves all six warnings, assembles four parallel CI security jobs, and sets a cadence for reviews and updates.