awesome-ruby-security

secure-headers

Manages application of security headers with many safe defaults

Rack::Attack

Middleware for blocking and throttling requests

Ronin

Ronin is a free and Open Source Ruby toolkit for security research and development

Salus

Multi purpose security scanning tool supporting Ruby, Node, Python and Go

Continuously and automatically finds & fixes vulnerabilities for Ruby and other languages

brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications

A set of rules to extend rubocop with additional security rules

dawnscanner

A static analysis security scanner for ruby applications. It supports Sinatra, Padrino and Ruby on Rails frameworks

git-secrets

Prevents you from committing secrets and credentials into git repositories

DevSkim

DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline

ban-sensitive-files

Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file)

rails_best_practices

A static code analyzer for Ruby on Rails applications that finds - among other things - common patterns that might lead to security vulnerabilities

A script that print out ruby on rails application routes/URLs

Bearer

A code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks

Patch-level verification for Ruby apps

ruby-advisory-db

Open source database of security advisories that are relevant to Ruby libraries

GemScanner

GemScanner identifies depreciated versions of gems in your ruby on rails project

RailsGoat

A vulnerable version of Rails that follows the OWASP Top 10

DeleteMe

Educational insecure Rails application

The essentials to read when dealing with Rails Applications

Applying static code analysis and dependency checking in your CI/CD pipeline

This Cheatsheet intends to provide quick basic Ruby on Rails security tips for developers. It complements, augments or emphasizes points brought up in the rails security guide from

Rails security checklist

🔑 Community-driven Rails Security Checklist

Phrack article by on finding security vulnerabilities in Rails applications

Zen Rails Security Checklist

A well-documented Rails security checklist

Rails security best practices

A good overview of usefull things to look out for when working with Rails

A detailed blog on Ruby on Rails security from developers perspective that contains OWASP Top & other application issues with fixes / recommendation and fix codes

Offensive security book for rubyist ( )

security blindspots of lockfile injection in the Ruby ecosystem

Newsletter catering towards developers and covering many languages

Found a bug in the Ruby language? Report it there

Follow the latest security announcements