#brakeman — Public Fediverse posts

#Brakeman 8.0.5 released! 🎉

Pretty much all bug fixes: https://brakemanscanner.org/blog/2026/06/12/brakeman-8-dot-0-dot-5-released

#ruby #rubyonrails #security

Public commitments help... Will have a #Brakeman release this week 👍

SATURDAY MATINEE MUSIC VIDEO “The Brakeman’s Dead”

https://www.youtube.com/watch?v=dL0SoNTyIWA

#train #steamtrain #locomotive #brakeman #engineer #conductor #NeilYoung #CrazyHorse #SanFrancisco #TomMallon #ChrisvonSneidern #MichaelMiller #AaronGregory #TheAlarm #MikePeters #BennettGreen #JohnStuart #Marshallamp #JohnnyJBlair #singeratlarge #singersongwriter

SATURDAY MATINEE MUSIC VIDEO “The Brakeman’s Dead”

https://www.youtube.com/watch?v=dL0SoNTyIWA

#train #steamtrain #locomotive #brakeman #engineer #conductor #NeilYoung #CrazyHorse #SanFrancisco #TomMallon #ChrisvonSneidern #MichaelMiller #AaronGregory #TheAlarm #MikePeters #BennettGreen #JohnStuart #Marshallamp #JohnnyJBlair #singeratlarge #singersongwriter

#Brakeman 8.0.3 is released!

Age delay option for `--ensure-latest` and some bug fixes!

https://brakemanscanner.org/blog/2026/02/26/brakeman-8-dot-0-dot-3-released

#ruby #rails #infosec

Oh, and another #Brakeman tip: feel free to report false positives for things Brakeman is just wrong about: https://github.com/presidentbeef/brakeman/issues

Only way it gets better is with your help!

#Brakeman needs to be kept up-to-date! It helps with false positives and true positives.

You can use --ensure-latest (returns non-zero exit code if there's a newer version) or a binstub like this to always run the latest version: https://gist.github.com/presidentbeef/0cba3fae686c8edc20c626a6cf1d21d9

Fun thread to wake up to: "Been ignoring Brakeman warnings for 2 years. Just found an actual SQL injection we missed."

Main issue: too many warnings!

Some tips for tuning:
* For CI, backlog and ignore existing warnings to only fail on new
* Filter low confidence warnings
* Turn off any checks that are noisy for your application

Brakeman _does_ do some data flow analysis to reduce false positives, but it also defaults to being a little paranoid!

https://www.reddit.com/r/rails/comments/1qyek84/been_ignoring_brakeman_warnings_for_2_years_just/

#brakeman #infosec

Some fixes for the new #Brakeman logger have been released in 8.0.1 and 8.0.2: https://github.com/presidentbeef/brakeman/releases/tag/v8.0.2

Let me know if you see any problems!

#rails #ruby

Some fixes for the new #Brakeman logger have been released in 8.0.1 and 8.0.2: https://github.com/presidentbeef/brakeman/releases/tag/v8.0.2

Let me know if you see any problems!

#rails #ruby

#Brakeman 8.0 is out! 🎉

Scanner progress logging has been completely revamped (and is the main reason for the major version bump). Please report any issues!

Additionally:
- Much better constant lookups!
- Better handling of singleton method names!
- No more low confidence dynamic render path warnings!
- Erubis is replaced with Erubi!
- Some old options were removed!

Check it out: https://brakemanscanner.org/blog/2026/01/29/brakeman-8-dot-0-dot-0-released

#ruby #rails #security

#Brakeman 8.0 is out! 🎉

Scanner progress logging has been completely revamped (and is the main reason for the major version bump). Please report any issues!

Additionally:
- Much better constant lookups!
- Better handling of singleton method names!
- No more low confidence dynamic render path warnings!
- Erubis is replaced with Erubi!
- Some old options were removed!

Check it out: https://brakemanscanner.org/blog/2026/01/29/brakeman-8-dot-0-dot-0-released

#ruby #rails #security

Okay so there are only a couple business days left in the month... I can't break my resolution immediately 😅 📆

So... #Brakeman 8.0 drops tomorrow.

#rails #ruby

ruby-lsp-brakeman is now working on Helix if you build Helix from the latest source. 🧬

#brakeman #ruby

Back to re-working #Brakeman output. Would love some feedback on this. Colors, animations... less? More? Different? Ship it?

#ruby

Back to re-working #Brakeman output. Would love some feedback on this. Colors, animations... less? More? Different? Ship it?

#ruby

BTW, would be great to have testing with more editors. So if you are using an LSP-compatible editor and working on a Rails app, let me know if ruby-lsp-brakeman works for you?

#brakeman #ruby

Released a new version of ruby-lsp-brakeman that fixes a little bug, so now it's compatible with more editors! I tested with Zed and it was definitely broken before. Helix is also broken, partly because of this and partly because it sends a different event that needs to be investigated.

Anyway, enjoy!
https://github.com/presidentbeef/ruby-lsp-brakeman/releases/tag/v0.0.3

#brakeman #ruby

Released a new version of ruby-lsp-brakeman that fixes a little bug, so now it's compatible with more editors! I tested with Zed and it was definitely broken before. Helix is also broken, partly because of this and partly because it sends a different event that needs to be investigated.

Anyway, enjoy!
https://github.com/presidentbeef/ruby-lsp-brakeman/releases/tag/v0.0.3

#brakeman #ruby

Lastly, my New Year's resolution is to target one #Brakeman release per month (like the old days!) as I slowly recover from being a CISO. 😩

Lastly, my New Year's resolution is to target one #Brakeman release per month (like the old days!) as I slowly recover from being a CISO. 😩

I'm seeing pretty good speedups in #Brakeman scan times going from #Ruby 3.4.8 to 4.0. In the range of 7-12% faster (very unscientific testing).

Also seeing significant improvement in scan times with JIT on 4.0, in the range of 25-35% faster for larger apps!

I'm seeing pretty good speedups in #Brakeman scan times going from #Ruby 3.4.8 to 4.0. In the range of 7-12% faster (very unscientific testing).

Also seeing significant improvement in scan times with JIT on 4.0, in the range of 25-35% faster for larger apps!

Merry Christmas and Happy #Ruby 4 day! ☃️

#Brakeman 7.1.2 has been released to fix a version issue with Ruby 4.0. It's been a while since I've had to do an "emergency" Christmas release for a new Ruby version 😆

Additionally:
* Minimum Ruby version is now 3.2.0
* Fixed SQL injection false positives with `count` (and other methods)
* Fixed more XSS false positives related to Haml's AttributeBuilder
* Updated documentation for report formats
* Upgraded to Minitest 6.0

https://brakemanscanner.org/blog/2025/12/25/brakeman-7-dot-1-dot-2-released

Merry Christmas and Happy #Ruby 4 day! ☃️

#Brakeman 7.1.2 has been released to fix a version issue with Ruby 4.0. It's been a while since I've had to do an "emergency" Christmas release for a new Ruby version 😆

Additionally:
* Minimum Ruby version is now 3.2.0
* Fixed SQL injection false positives with `count` (and other methods)
* Fixed more XSS false positives related to Haml's AttributeBuilder
* Updated documentation for report formats
* Upgraded to Minitest 6.0

https://brakemanscanner.org/blog/2025/12/25/brakeman-7-dot-1-dot-2-released

#Brakeman 7.1.1 finally released! Faster file search on MacOS, word wrapping of text report, and lots of bug fixes from lots of contributors!

https://brakemanscanner.org/blog/2025/11/03/brakeman-7-dot-1-dot-1-released

#rubyonrails #security

#Brakeman 7.1.1 finally released! Faster file search on MacOS, word wrapping of text report, and lots of bug fixes from lots of contributors!

https://brakemanscanner.org/blog/2025/11/03/brakeman-7-dot-1-dot-1-released

#rubyonrails #security

Working through a bit of the backlog for #Brakeman pull requests, with an eye towards getting a release out in the next week or two. Really appreciate everyone continuing to use and contribute to the project!

#ruby #rails

I guess #Brakeman needs nice word wrapping now.

Proper announce post eventually, but... here are LLM-enhanced warning messages for #Brakeman!

Powered by the lovely RubyLLM library, use whatever LLM provider you'd like to generate more detailed warnings. This helps bridge the understanding gap from "brief Brakeman warning" to "oh that's what is going on and how I can fix it".

Give it a spin and report any issues/suggestions!

https://github.com/presidentbeef/brakeman-llm

Alright, the #Brakeman website design has been updated for the first time since it was launched 14 years ago (yes, really that long). Let me know if anything is broken!

https://brakemanscanner.org/

Alright, the #Brakeman website design has been updated for the first time since it was launched 14 years ago (yes, really that long). Let me know if anything is broken!

https://brakemanscanner.org/

Brakeman 7.1.0 is released! Support for Haml 6.x, render shortcuts, and more: https://brakemanscanner.org/blog/2025/07/18/brakeman-7-dot-1-dot-0-released

#ruby #rails #brakeman

I owe a lot to #RailsConf. I've been fortunate enough to present there six times (plus a couple lightning talks), starting way back in 2012 introducing #Brakeman to the Rails world. I'm happy with the impact I've made in this small corner of web security as a result.

Haven't been to one since pre-pandemic, but still sad to see it ending. Thanks to those who have organized and kept it running so long and gave me so many opportunities!

Took a little while to get back to this, but I will be releasing a new library to tie in LLM-generated explanations to #brakeman warnings soon. It essentially wraps RubyLLM so you can call into any of the supported providers very easily.

Currently working on Haml 6 support in #Brakeman.

After that, investigating and add in "new" ActiveRecord methods for SQL injection. And getting back to refactoring and updating the console output.

Also need to get back to some folks on open PRs. 😅 I'm a bit behind...

Currently working on Haml 6 support in #Brakeman.

After that, investigating and add in "new" ActiveRecord methods for SQL injection. And getting back to refactoring and updating the console output.

Also need to get back to some folks on open PRs. 😅 I'm a bit behind...

#brakeman + RubyLLM = customized AI generated descriptions of security warnings and potential fixes? Would people be interested in having that?

And yeah I've already prototyped this and it does work reasonably well.

#ruby #security

#Brakeman 7.0.1 (and 7.0.2) released!

Bug fixes, Prism compatibility improvement, and enabling custom Gemfiles:

https://brakemanscanner.org/blog/2025/04/03/brakeman-7-dot-0-dot-1-released

#ruby #rubyonrails #security

Finally had some time to test Brakeman a little more scientifically with JIT on Ruby 3.4.1. I think it's safe to say you should turn on the JIT compiler when running Brakeman! Based on these results, you could see 7-10% improvement in scan times.

(Tested on x86_64)

#ruby #rubyonrails #brakeman

Thoughts on this cleaner, more colorful #Brakeman output? 🤔 Very open to suggestions.

#ruby

Ahh #brakeman is on the code quality list but not on the "gems that frustrate you" list 😎
https://railsdeveloper.com/survey/2024/#testing-code-quality

#ruby #rails

Relatedly, I'm well on the way to redoing the "rescanning" feature in #Brakeman. For now, it's focused on re-parsing only changed files. Everything else gets processed again. This is a change from before where Brakeman would try to carefully manipulate internal state based on guessing what type of file changed and what the ripple effects would be. It was a real mess, and also it's been broken for quite a while.

#ruby #rubyonrails

Thought this was coming in Rails 8, but I guess it's already released! 😯

#brakeman #ruby #rails

So after #Brakeman development slowed wwaaayyyyy down in the last year (thanks to my new work responsibilities), suddenly it will be included as a default dependency _and_ part of the default GitHub CI configuration generator in Rails 8.

This is really cool and I hope it benefits security of new Rails apps. I suspect a lot new bug reports/feature requests coming in as well 😅 but that will be a good thing!

https://github.com/rails/rails/pull/50508
https://github.com/rails/rails/pull/50507
#ruby #rubyonrails