Security scan on your Rails app with Brakeman via Docker

Brakeman is a static analyzer that catches classic Rails vulnerabilities: SQL injection, mass-assignment, XSS, open redirect. I prefer running it via Docker to avoid polluting the Gemfile with a scan dependency and to use the latest version without touching the project.

docker run -v ~/work/overgrad:/code presidentbeef/brakeman --color

Replace ~/work/overgrad with your repo path — it mounts the code into the container and runs the scan.

Using it in CI

The same image works as a step in any CI pipeline. In GitHub Actions, for example, you can run it as a container and fail the build if a high-severity warning appears.

- name: Brakeman
  run: docker run --rm -v $:/code presidentbeef/brakeman -w2 --no-progress

-w2 filters medium/high severity warnings (-w3 shows only high).