Dawnscanner
Dawnscanner is a free, MIT-licensed static analysis security scanner for Ruby web applications.
What Dawnscanner is
Dawnscanner is a free, MIT-licensed static analysis security scanner for Ruby web applications. It supports Ruby on Rails, Sinatra, and Padrino, and reads a project's Gemfile.lock to identify the Ruby version and MVC framework before applying relevant checks. The README says version 2.0 has more than 680 checks in its knowledge base, which includes NIST CVE bulletins, custom checks, and OWASP Ruby on Rails cheat-sheet recommendations. Dawn can analyze view code and trace sinks to identify cross-site scripting and SQL injection issues. Its text-format results list vulnerabilities and mitigation actions. The tool runs locally from the command line on Linux or in a self-hosted setup. Installation uses `gem install dawnscanner`, and users must download the knowledge base separately. The README gives GitHub hooks as an example of using Dawn in a release process. The listed plan costs nothing; there is no free trial. IDE support and CI/CD support are listed as unavailable.
Good
- Supports three Ruby web frameworks
- Knowledge base includes over 680 checks
- Results include mitigation actions
- Free and MIT licensed
Watch out
- Results are available in text format only
- Knowledge base requires separate download
- No IDE support
- No CI/CD support
Who it suits
It suits developers and teams working with Ruby web applications who want a locally run source scanner. Its supported frameworks are Rails, Sinatra, and Padrino.
Verdict
Dawnscanner focuses on Ruby application checks and provides vulnerability findings with mitigation actions. Users should note its text-only results and separate knowledge-base download.
Plans and prices
From Dawnscanner's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Dawnscanner | Free | MIT-licensed Ruby security scanner · runs locally from the command line |
The facts
Each one read from Dawnscanner's own pages, with the date it was checked.
What it does
- Analysis
- Dawn reads Gemfile.lock, detects the Ruby version and MVC framework, and applies relevant checks.checked 8 Oct 2026
- Checks
- The README says version 2.0 has more than 680 security checks in its knowledge base.checked 8 Oct 2026
- Code analysis
- It can analyze view code and trace sinks to identify cross-site scripting and SQL injection issues.checked 8 Oct 2026
- Distribution
- The repository identifies the project as MIT licensed.checked 8 Oct 2026
- Frameworks
- It supports Ruby on Rails, Sinatra, and Padrino applications.checked 8 Oct 2026
- Installation
- The README instructs users to install the tool with `gem install dawnscanner` and download its knowledge base separately.checked 8 Oct 2026
- Integration
- The README mentions use with GitHub hooks as an example of integrating Dawn into a release process.checked 8 Oct 2026
- Knowledge base
- The knowledge base includes NIST CVE bulletins, custom checks, and OWASP Ruby on Rails cheat-sheet recommendations.checked 8 Oct 2026
- Purpose
- Dawn is a static analysis security scanner for Ruby web applications.checked 8 Oct 2026
- Results
- Scan results list vulnerabilities and mitigation actions, and the README says they are available in text format only.checked 8 Oct 2026
- Security data updates
- The knowledge-base repository lists v20240116 as its latest release.checked 8 Oct 2026
- Support
- The README invites users to provide feedback and support the project by opening an issue with a reference.checked 8 Oct 2026
Alternatives to Dawnscanner
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 3
Qlty Cloud
Free planWebAPIExtensionLinux7.2From $20 a month - 4
Codacy
Free planWebExtension7.0From $18 a year - 5
Semgrep Supply Chain
Free planWebAPILinuxmacOS7.0From $30 a month - 6
Reek
Free planLinux6.2Free plan