Secure Your Rails Applications

Brakeman is a free vulnerability scanner designed for Ruby on Rails applications. Statically analyze Rails application code to find security issues at any stage of development.

🚀 Get Started 📖 Read Documentation
terminal
# Install Brakeman
gem install brakeman
# Scan your Rails app
brakeman
== Brakeman Report ==
# ...

Why Use Brakeman?

Fast and easy security scans built by the community

🎯

Rails-Specific

Built specifically for Ruby on Rails. Understands Rails patterns, conventions, and common vulnerability patterns.

🔧

Zero Configuration

Works out of the box with sensible defaults.

🔍

Broad Coverage

Detects SQL injection, cross-site scripting, command injection, and dozens of other vulnerability types.

Latest News

Stay up to date with the latest releases and community contributions

Version 8.1.0

Brakeman 8.1.0

September 2026 • Updated SonarQube format, updated validation regex warnings, more!

SonarQube Report Format

🎉 What's New

  • Update SonarQube report to use generic issue format (fangxing)
  • Include regex code in validation warnings (Eliot Sykes)
  • Check validation regexes in non-activerecord models (Eliot Sykes)
  • Skip top-level vendor directory before recursive globbing (Conor O’Donnell)
Read Full Release Notes →

Brakeman 8.0.6

Rails 8.0 EOL Date

August 2026

Brakeman 8.0.5

Breaking with tradition, since these are all bug fixes that are pretty clear from the description I will not be...

June 2026

Brakeman 8.0.3

Add Age Option for Latest Release

February 2026

Brakeman 8.0.1

(Changes)

January 2026