A static analysis security vulnerability scanner for Ruby on Rails applications
This report summarizes scanner evidence for presidentbeef/brakeman, a Ruby project with 7,279 GitHub stars. SynthScan examined 84,095 lines of code across 858 source files, recording 324 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 5.1 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 324 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 9 finding(s).
Which changes need focused human review? 324 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 324 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …st/apps/rails3.1/app/assets/javascripts/application.js | 1 | // This is a manifest file that'll be compiled into including all the files listed below. | COMMENT |
| LOW | …st/apps/rails3.1/app/assets/stylesheets/users.css.scss | 1 | // Place all the styles related to the Users controller here. | COMMENT |
| LOW | test/apps/rails3.1/config/routes.rb | 41 | # This route can be invoked with purchase_url(:id => product.id) | COMMENT |
| LOW | test/apps/rails3.1/config/routes.rb | 61 | # resource :seller | COMMENT |
| LOW | test/apps/rails3.1/config/routes.rb | 81 | # root :to => 'welcome#index' | COMMENT |
| LOW | test/apps/rails3.1/config/application.rb | 21 | # Only load the plugins named here, in the order given (default is alphabetical). | COMMENT |
| LOW | test/apps/rails3.1/config/environments/production.rb | 21 | config.assets.digest = true | COMMENT |
| LOW | test/apps/rails3.1/config/environments/production.rb | 41 | COMMENT | |
| LOW | test/apps/rails3.1/config/environments/test.rb | 21 | # Raise exceptions instead of rendering exception templates | COMMENT |
| LOW | …ps/rails3.1/config/initializers/backtrace_silencers.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | test/apps/rails3.1/config/initializers/mime_types.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | test/apps/rails3.1/config/initializers/session_store.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | test/apps/rails3.1/config/initializers/secret_token.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | test/apps/rails3.1/config/initializers/inflections.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | test/apps/rails3.1/public/robots.txt | 1 | # See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file | COMMENT |
| LOW | test/apps/rails3.1/db/seeds.rb | 1 | # This file should contain all the record creation needed to seed the database with its default values. | COMMENT |
| LOW | test/apps/rails7/app/assets/config/manifest.js | 1 | //= link_tree ../images | COMMENT |
| LOW | test/apps/rails7/config/storage.yml | 1 | test: | COMMENT |
| LOW | test/apps/rails7/config/storage.yml | 21 | # credentials: <%= Rails.root.join("path/to/gcs.keyfile") %> | COMMENT |
| LOW | test/apps/rails7/config/puma.rb | 1 | # Puma can serve each request in a thread from an internal thread pool. | COMMENT |
| LOW | test/apps/rails7/config/puma.rb | 21 | # | COMMENT |
| LOW | test/apps/rails7/config/locales/en.yml | 1 | # Files in the config/locales directory are used for internationalization | COMMENT |
| LOW | test/apps/rails7/config/locales/en.yml | 21 | # | COMMENT |
| LOW | test/apps/rails7/config/environments/production.rb | 21 | # config.require_master_key = true | COMMENT |
| LOW | test/apps/rails7/config/environments/production.rb | 41 | config.active_storage.service = :local | COMMENT |
| LOW | test/apps/rails7/config/environments/production.rb | 81 | # Use a different logger for distributed setups. | COMMENT |
| LOW | test/apps/rails7/config/environments/production.rb | 101 | # | COMMENT |
| LOW | test/apps/rails7/config/environments/production.rb | 121 | # in a proc. See guides for an example. | COMMENT |
| LOW | test/apps/rails7/config/environments/development.rb | 61 | COMMENT | |
| LOW | test/apps/rails7/config/initializers/assets.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | …/apps/rails7/config/initializers/permissions_policy.rb | 1 | # Define an application-wide HTTP permissions policy. For further | COMMENT |
| LOW | …/rails7/config/initializers/content_security_policy.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | …/rails7/config/initializers/content_security_policy.rb | 21 | # config.content_security_policy_nonce_directives = %w(script-src) | COMMENT |
| LOW | test/apps/rails7/config/initializers/inflections.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | test/apps/rails_with_xss_plugin/test/test_helper.rb | 1 | ENV["RAILS_ENV"] = "test" | COMMENT |
| LOW | test/apps/rails_with_xss_plugin/test/test_helper.rb | 21 | # any transactions started in your code will be automatically rolled back. | COMMENT |
| LOW | test/apps/rails_with_xss_plugin/config/routes.rb | 21 | COMMENT | |
| LOW | test/apps/rails_with_xss_plugin/config/environment.rb | 1 | # Be sure to restart your server when you modify this file | COMMENT |
| LOW | test/apps/rails_with_xss_plugin/config/environment.rb | 21 | # config.gem "aws-s3", :lib => "aws/s3" | COMMENT |
| LOW | …ails_with_xss_plugin/config/environments/production.rb | 21 | # Enable serving of images, stylesheets, and javascripts from an asset server | COMMENT |
| LOW | …apps/rails_with_xss_plugin/config/environments/test.rb | 21 | # The :test delivery method accumulates sent emails in the | COMMENT |
| LOW | …_xss_plugin/config/initializers/backtrace_silencers.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | …ails_with_xss_plugin/config/initializers/mime_types.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | …s_with_xss_plugin/config/initializers/session_store.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | …ugin/config/initializers/cookie_verification_secret.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | …ils_with_xss_plugin/config/initializers/inflections.rb | 1 | # Be sure to restart your server when you modify this file. | COMMENT |
| LOW | test/apps/rails_with_xss_plugin/public/robots.txt | 1 | # See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file | COMMENT |
| LOW | …s/rails_with_xss_plugin/public/javascripts/controls.js | 1 | // Copyright (c) 2005-2008 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us) | COMMENT |
| LOW | …s/rails_with_xss_plugin/public/javascripts/controls.js | 21 | // invoking this.getToken(), NOT by directly accessing | COMMENT |
| LOW | …s/rails_with_xss_plugin/public/javascripts/controls.js | 381 | // Extra local autocompletion options: | COMMENT |
| LOW | …ails_with_xss_plugin/public/javascripts/application.js | 1 | // Place your application-specific JavaScript functions and classes here | COMMENT |
| LOW | test/apps/rails_with_xss_plugin/db/seeds.rb | 1 | # This file should contain all the record creation needed to seed the database with its default values. | COMMENT |
| LOW | test/apps/rails5.2/app/assets/config/manifest.js | 1 | //= link_tree ../images | COMMENT |
| LOW | …st/apps/rails5.2/app/assets/javascripts/application.js | 1 | // This is a manifest file that'll be compiled into application.js, which will include all the files | COMMENT |
| LOW | test/apps/rails5.2/config/storage.yml | 1 | test: | COMMENT |
| LOW | test/apps/rails5.2/config/storage.yml | 21 | # keyfile: <%= Rails.root.join("path/to/gcs.keyfile") %> | COMMENT |
| LOW | test/apps/rails5.2/config/puma.rb | 1 | # Puma can serve each request in a thread from an internal thread pool. | COMMENT |
| LOW | test/apps/rails5.2/config/puma.rb | 21 | # Workers do not work on JRuby or Windows (both of which do not support | COMMENT |
| LOW | test/apps/rails5.2/config/puma.rb | 41 | # end | COMMENT |
| LOW | test/apps/rails5.2/config/locales/en.yml | 1 | # Files in the config/locales directory are used for internationalization | COMMENT |
| 177 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …t/apps/rails3.1/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | …/apps/rails7/config/initializers/permissions_policy.rb | 1 | # Define an application-wide HTTP permissions policy. For further | COMMENT |
| MEDIUM | …/rails7/config/initializers/content_security_policy.rb | 3 | # Define an application-wide content security policy | COMMENT |
| MEDIUM | test/apps/rails_with_xss_plugin/db/schema.rb | 1 | # This file is auto-generated from the current state of the database. Instead of editing this file, | COMMENT |
| MEDIUM | …t/apps/rails5.2/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | …ails5.2/config/initializers/content_security_policy.rb | 1 | # Define an application-wide content security policy | COMMENT |
| MEDIUM | …/apps/rails8/config/initializers/permissions_policy.rb | 3 | # Define an application-wide HTTP permissions policy. For further | COMMENT |
| MEDIUM | …/rails8/config/initializers/content_security_policy.rb | 3 | # Define an application-wide content security policy. | COMMENT |
| MEDIUM | test/apps/rails6/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | …/rails6/config/initializers/content_security_policy.rb | 3 | # Define an application-wide content security policy | COMMENT |
| MEDIUM | …s4_with_engines/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | …ndard_structure/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | test/apps/rails4/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | …t/apps/rails3.2/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | test/apps/rails5/config/initializers/wrap_parameters.rb | 3 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | lib/brakeman/file_path.rb | 11 | # Create a new FilePath using an AppTree object. | COMMENT |
| MEDIUM | lib/brakeman/file_path.rb | 32 | # Create a new FilePath with the given absolute and relative paths. | COMMENT |
| MEDIUM | lib/brakeman/messages.rb | 3 | # Create a new message from a list of messages. | COMMENT |
| MEDIUM⚡ | lib/brakeman/messages.rb | 17 | # Create a new code message fragment | COMMENT |
| MEDIUM⚡ | lib/brakeman/messages.rb | 22 | # Create a new message fragment with a CVE identifier | COMMENT |
| MEDIUM⚡ | lib/brakeman/messages.rb | 27 | # Create a new message fragment representing a file name | COMMENT |
| MEDIUM⚡ | lib/brakeman/messages.rb | 32 | # Create a new message fragment from a user input type (e.g. `:params`). | COMMENT |
| MEDIUM⚡ | lib/brakeman/messages.rb | 38 | # Create a new message fragment which will not be modified during output | COMMENT |
| MEDIUM⚡ | lib/brakeman/messages.rb | 43 | # Create a new plain string message fragment | COMMENT |
| MEDIUM⚡ | lib/brakeman/messages.rb | 48 | # Create a message fragment representing the version of a library | COMMENT |
| MEDIUM | lib/brakeman/file_parser.rb | 6 | # This class handles reading and parsing files. | COMMENT |
| MEDIUM | lib/brakeman/app_tree.rb | 77 | # Create a new Brakeman::FilePath | COMMENT |
| MEDIUM | lib/brakeman/checks/check_link_to.rb | 99 | # Create a warn for this xss | COMMENT |
| MEDIUM | lib/brakeman/processors/lib/processor_helper.rb | 24 | #This method is used because Sexp#args and Sexp#arglist create new objects. | COMMENT |
| MEDIUM | lib/ruby_parser/bm_sexp.rb | 17 | #Defining a method named "return" seems like a bad idea, so we have to | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/apps/rails7/config/environments/production.rb | 68 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | test/apps/rails5.2/config/environments/production.rb | 69 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | test/apps/rails8/config/environments/production.rb | 74 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | test/apps/rails6/config/environments/production.rb | 66 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | …/rails4_with_engines/config/environments/production.rb | 65 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | …n_standard_structure/config/environments/production.rb | 60 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | test/apps/rails4/config/environments/production.rb | 65 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | test/apps/rails5/config/environments/production.rb | 67 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | lib/brakeman/file_path.rb | 43 | # Read file from absolute path. | COMMENT |
| LOW | lib/brakeman/file_path.rb | 48 | # Check if absolute path exists. | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 168 | #Check if _exp_ represents a hash: s(:hash, {...}) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 177 | #Check if _exp_ represents an array: s(:array, [...]) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 182 | #Check if _exp_ represents a String: s(:str, "...") | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 191 | #Check if _exp_ represents a Symbol: s(:lit, :...) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 196 | #Check if _exp_ represents a method call: s(:call, ...) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 202 | #Check if _exp_ represents a Regexp: s(:lit, /.../) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 207 | #Check if _exp_ represents an Integer: s(:lit, ...) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 212 | #Check if _exp_ represents a number: s(:lit, ...) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 217 | #Check if _exp_ represents a result: s(:result, ...) | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 222 | #Check if _exp_ represents a :true, :lit, or :string node | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 229 | #Check if _exp_ represents a :false or :nil node | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 235 | #Check if _exp_ represents a block of code | COMMENT |
| LOW⚡ | lib/brakeman/util.rb | 241 | #Check if _exp_ is a params hash | COMMENT |
| LOW | lib/brakeman/util.rb | 286 | #Check if exp is params, cookies, or request_headers | COMMENT |
| LOW | lib/brakeman/util.rb | 304 | #Check if _exp_ is a Sexp. | COMMENT |
| LOW | lib/brakeman/util.rb | 309 | #Check if _exp_ is a Sexp and the node type matches one of the given types. | COMMENT |
| LOW | lib/brakeman/checks.rb | 72 | #Add Warning to list of warnings to report. | COMMENT |
| LOW | lib/brakeman/checks/check_basic_auth.rb | 60 | # Check if the block of a result contains a comparison of password to string | COMMENT |
| LOW | lib/brakeman/checks/check_model_attributes.rb | 3 | #Check if mass assignment is used with models | COMMENT |
| LOW | lib/brakeman/checks/check_redirect.rb | 236 | #Check if method is actually an association in a Model | COMMENT |
| LOW | lib/brakeman/checks/check_link_to.rb | 76 | # Check if we should warn about the specified method | COMMENT |
| LOW | lib/brakeman/checks/check_link_to.rb | 89 | # Check if we should warn about the matched result | COMMENT |
| LOW | lib/brakeman/checks/check_render.rb | 30 | #Check if path to action or file is determined dynamically | COMMENT |
| LOW | lib/brakeman/checks/check_json_parsing.rb | 41 | #Check if `yajl` is included in Gemfile | COMMENT |
| LOW | lib/brakeman/checks/check_select_tag.rb | 35 | #Check if select_tag is called with user input in :prompt option | COMMENT |
| LOW | lib/brakeman/processors/alias_processor.rb | 893 | # Check if exp is a call to Array#include? on an array literal | COMMENT |
| LOW | lib/brakeman/processors/alias_processor.rb | 911 | # Check if exp is a call to Array#include? on an array literal | COMMENT |
| LOW | lib/brakeman/processors/alias_processor.rb | 922 | # Check if exp is a call to Hash#include? on a hash literal | COMMENT |
| LOW | lib/brakeman/processors/alias_processor.rb | 940 | #Check if a branch is obviously going to be taken | COMMENT |
| LOW | lib/brakeman/processors/alias_processor.rb | 1451 | #Set variable to given value. | COMMENT |
| LOW | lib/brakeman/processors/lib/rails3_config_processor.rb | 104 | #Check if an expression includes a call to set Rails config | COMMENT |
| LOW | lib/brakeman/processors/lib/rails2_config_processor.rb | 36 | # Check if config is set to use Erubis | COMMENT |
| LOW | lib/brakeman/processors/lib/rails2_config_processor.rb | 85 | #Check if an expression includes a call to set Rails config | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/tests/brakeman.rb | 582 | def parse_ruby_version_from_lock(version_string) | CODE |
| LOW | test/tests/app_tree.rb | 6 | def temp_dir_and_file_from_path(relative_path) | CODE |
| LOW | test/tests/app_tree.rb | 15 | def temp_dir_absolute_symlink_and_file_from_path(relative_path) | CODE |
| LOW | test/tests/app_tree.rb | 33 | def temp_dir_relative_symlink_and_file_from_path(relative_path) | CODE |
| LOW | test/apps/rails3.1/app/controllers/admin_controller.rb | 62 | def authenticate_token_or_basic(&block) | CODE |
| LOW | …/apps/rails7/app/controllers/application_controller.rb | 13 | def endless_method_definition(msg) = puts "#{Time.now}: #{msg}" | CODE |
| LOW | test/apps/rails6/app/models/group.rb | 16 | def fetch_constant_hash_value(role_name) | CODE |
| LOW | test/apps/rails3/app/models/notifier.rb | 2 | def nsfree_deactivation_heroku(account, allowed, used) | CODE |
| LOW | lib/brakeman/tracker/collection.rb | 64 | def method_definition_receiver(receiver) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lib/brakeman/processors/alias_processor.rb | 255 | # so just pass in first argument, but process_array_access expects | COMMENT |
| LOW | lib/brakeman/processors/alias_processor.rb | 1394 | #If either clause is more than a single expression, just use entire | COMMENT |
| MEDIUM | lib/brakeman/processors/lib/find_call.rb | 19 | #in conjunction with AliasProcessor.) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/to_test.rb | 6 | #Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/apps/rails5.2/config/puma.rb | 30 | # you need to make sure to reconnect any threads in the `on_worker_boot` | COMMENT |