Brakeman

CodeRabbit runs Brakeman to identify security vulnerabilities in Ruby on Rails applications.

Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities. It scans your application’s code for potential security issues and provides detailed reports.

CodeRabbit runs Brakeman v8.0.6.

Files

Brakeman will run when a pull request changes files with the following names and extensions:

• Gemfile
• *.rb
• *.erb

Configuration

enabled · boolean · default: true

Enable Brakeman

.coderabbit.yaml

.coderabbit.yaml

reviews:
  tools:
    brakeman:
      enabled: true

Web UI

In your organization or repository settings, go to Reviews → Tools and turn the tool on or off with its toggle.

Security policy and restrictions

CodeRabbit runs Brakeman in a sandbox with its built-in checks. Repository-provided external checks and Ruby check bundles are not loaded.

When we skip Brakeman

CodeRabbit will skip running Brakeman when:

• No Rails files are found in the pull request.
• Brakeman is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

Features

Brakeman can detect many critical vulnerabilities such as:

• SQL injection
• Cross-site scripting (XSS)
• Mass assignment
• Remote code execution
• And many more security vulnerabilities
• Out of date package versions
• Etc

Links

• Brakeman Official Website
• Brakeman GitHub Repository
• Brakeman Documentation
• Warning Types