Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
What Brakeman is
Brakeman is a static analysis scanner for Ruby on Rails application code. It looks for potential security vulnerabilities using patterns and conventions specific to Rails, with documented warnings for SQL injection, cross-site scripting, command injection, cross-site request forgery, path traversal, and unsafe deserialization. It can be installed as a Ruby gem, through Bundler, or with Docker, and used from the command line or as a Ruby library. Reports are available as text, HTML, JSON, JUnit XML, or Markdown; JSON is recommended for automation. Each warning has a High, Medium, or Weak confidence rating, which estimates how likely it is to indicate a real problem. Brakeman is designed for automated runs and documents integrations including Ruby LSP, Guard, Vim ALE, GitHub Actions, and Jenkins. The project says it should work with Rails 2.3.x through 8.x and requires Ruby 3.2.0 or later. Its faster option disables some features and can miss vulnerabilities. A free plan is listed as free; the project says it is free for non-commercial use.
Good
- Checks for multiple documented Rails vulnerability types
- Supports text, HTML, JSON, JUnit XML, and Markdown reports
- Can run from the command line or as a Ruby library
- Documents integrations for editors and continuous integration
Watch out
- Requires Ruby 3.2.0 or later
- False positives are possible
- The faster option may miss vulnerabilities
- Free use is listed for non-commercial use
Who it suits
Brakeman suits developers maintaining Ruby on Rails applications who want source-code security checks, including in automated workflows. It is a fit for teams comfortable running Ruby software on Linux or in a self-hosted setup.
Verdict
Brakeman focuses on Rails-specific source-code analysis and offers several report formats and automation integrations. Readers should account for its Ruby requirement and the possibility of false positives when interpreting warnings.
Plans and prices
From Brakeman's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Brakeman | Free | Free vulnerability scanner for Ruby on Rails applications; GitHub README says free for non-commercial use |
The facts
Each one read from Brakeman's own pages, with the date it was checked.
What it does
- Automation
- Brakeman is designed for automated runs and documents integrations including Ruby LSP, Guard, Vim ALE, and Jenkins.checked 9 Oct 2026
- CI integrations
- The project README also points to GitHub Actions and a Jenkins/Hudson plugin for continuous integration.checked 9 Oct 2026
- Compatibility
- The project README says Brakeman should work with Rails 2.3.x through 8.x and requires Ruby 3.2.0 or later to run.checked 9 Oct 2026
- Confidence ratings
- Warnings have High, Medium, or Weak confidence levels, which estimate how likely a warning is to represent a problem.checked 9 Oct 2026
- Detection coverage
- The documented warning types include SQL injection, cross-site scripting, command injection, cross-site request forgery, path traversal, and unsafe deserialization.checked 9 Oct 2026
- False positives
- The documentation cautions that Brakeman can produce false positives because it can only guess at the meaning of application code.checked 9 Oct 2026
- Install options
- Brakeman can be installed as a Ruby gem, through Bundler, or using Docker.checked 9 Oct 2026
- Latest release
- The homepage lists Brakeman 8.1.0, dated September 2026, with updates to SonarQube reporting and validation regex warnings.checked 9 Oct 2026
- Library use
- Although designed as a command-line application, Brakeman can also be run as a Ruby library with Brakeman.run.checked 9 Oct 2026
- Performance option
- The --faster option disables some features and may cause Brakeman to miss vulnerabilities.checked 9 Oct 2026
- Purpose
- Brakeman is a static analysis scanner that checks Ruby on Rails application code for potential security vulnerabilities.checked 9 Oct 2026
- Rails focus
- It is built specifically for Rails and understands Rails patterns, conventions, and common vulnerability patterns.checked 9 Oct 2026
- Reports
- It can output text, HTML, JSON, JUnit XML, and Markdown reports; JSON is recommended for automation.checked 9 Oct 2026
- Support
- The project links users to GitHub Discussions and Issues for community questions and bug reports.checked 9 Oct 2026
Alternatives to Brakeman
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 3
Qlty Cloud
Free planWebAPIExtensionLinux7.2From $20 a month - 4
Codacy
Free planWebExtension7.0From $18 a year - 5
Semgrep Supply Chain
Free planWebAPILinuxmacOS7.0From $30 a month - 6
Reek
Free planLinux6.2Free plan