Secure Your Ruby on Rails App: Brakeman vs Grype vs Bundler Audit

Today we are going to talk about some cool tools that help keep Ruby systems safe from bad guys. Let’s focus on Brakeman, and compare it to a couple of others.

What is Brakeman?

Brakeman is like a highly intelligent detective for your Ruby on Rails code. Monitors your program and tries to spot any security issues before they become a real problem. It’s like a friend checking your homework for mistakes before handing it in. For more information, visit https://github.com/presidentbeef/brakeman

How does Brakeman work?

Brakeman reads your code and looks for potentially dangerous patterns. For example, if you accidentally left a "back door" that allows hackers to enter,  Brakeman will notice and let you know. It’s really quick and allows you to review an entire project in just seconds!

Brakeman vs. Other Tools

There are other tools that work the same way. Let’s take a look at two of them:

Grype https://github.com/anchore/grype

• The Grype is more of a general security scanner.
• It can monitor projects, not just Ruby. It supported Ruby (Gems), Java (JAR, WAR, EAR, JPI, HPI), JavaScript (NPM, Yarn), Python (Egg, Wheel, Poetry, requirements.txt/setup.py files), Dotnet (deps.json), Golang (go.mod), PHP (Composer), Rust (Cargo)
• Grype focuses on finding vulnerabilities in the packages or libraries you use.

Bundler Audit https://github.com/rubysec/bundler-audit

• This tool is specifically for Ruby projects.
• It controls which gems (libraries) you use in your project.
• Bundler Audit shows you if any of your gems have detected security problems.

How are they different?

• Brakeman reviews YOUR code for problems.
• Grype keeps track of the tools and libraries you use, for a wide range of projects.
• Bundler audit only checks Ruby gems as known information.

Why use Brakeman?

Brakeman is great because:

• It's fast
• It's easy to use
• It finds problems in the code YOU write
• It gives helpful suggestions on how to fix issues

Set up and run Brakeman security scanner

Add Brakeman to your project:
gem install brakeman
For rbenv users, refresh the environment:
rm -rf ~/.rbenv/shims && rbenv rehash
Generate a security report:
brakeman -o brakeman_report.html
This will create an HTML file with the scan results.

Remember, no tool is perfect, but using Brakeman along with others like Grype and Bundler Audit can make your Ruby projects much safer.