Brakeman

CodeRabbit runs Brakeman to identify security vulnerabilities in Ruby on Rails applications.

Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities. It scans your application’s code for potential security issues and provides detailed reports; CodeRabbit runs Brakeman version 8.0.6.

Files

Brakeman will run when a pull request changes files with the following names and extensions:

• Gemfile
• *.rb
• *.erb

Configuration

Brakeman is enabled by default. Enable or disable it with .coderabbit.yaml or the CodeRabbit web UI:

.coderabbit.yaml

.coderabbit.yaml

reviews:
  tools:
    brakeman:
      enabled: true

Web UI

Go to Reviews → Tools → Brakeman in your organization or repository settings and toggle Brakeman on or off.

Security policy and restrictions

CodeRabbit runs Brakeman in a sandbox with its built-in checks. Repository-provided external checks and Ruby check bundles are not loaded.

When we skip Brakeman

CodeRabbit will skip running Brakeman when:

• No Rails files are found in the pull request.
• Brakeman is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

Features

Brakeman can detect many critical vulnerabilities such as:

• SQL injection
• Cross-site scripting (XSS)
• Mass assignment
• Remote code execution
• And many more security vulnerabilities
• Out of date package versions
• Etc

Links

• Brakeman Official Website
• Brakeman GitHub Repository
• Brakeman Documentation
• Warning Types