rails-securitylisted

# /rails-security — Brakeman + bundler-audit Combined Rails security scan. No credentials. Subcommands: `vulns`, `cves`, `audit`, `diff`, `ignore`, `update`. ## Overview Combined Brakeman (static analysis) + bundler-audit (CVE) scan for Rails apps. `diff` mode is the killer feature: shows only NEW issues vs base branch via git worktree (non-destructive — never touches your working tree). ## When to Use - Pre-PR security gate (new SQL injection, XSS, CSRF, mass-assignment) - Auditing `Gemfile.lock` for known CVEs - PR review: only see what THIS PR introduced, not pre-existing noise - Adding ignored issues with documented reason for audit trail ## When NOT to Use - Non-Rails projects → Brakeman is Rails-specific - Runtime / dynamic security testing → use OWASP ZAP, not static scanners - Dependency updates not security-related → use Dependabot / Renovate - Auditing infrastructure (Docker, k8s) → wrong scope ## Dependencies ```bash gem install brakeman bundler-audit ``` If a tool is missing, the relevant subcommand is skipped with a clear message. ## Helpers ```bash brakeman_cmd() { if [ -f "${1:-.}/Gemfile" ] && grep -q "brakeman" "${1:-.}/Gemfile" 2>/dev/null; then echo "bundle exec brakeman" else echo "brakeman" fi } ``` ## Dispatch ### `vulns [path] [--severity high|medium|low|all]` — Brakeman scan ```bash PATH_ARG="${1:-.}"; SEV="${SEV:-medium}" mapfile -t CMD < <(brakeman_cmd "$PATH_ARG" | tr ' ' '\n') "${CMD[@]}" -p "$PATH_ARG" -f json -o /tmp/b