DepWarden's free Ruby SAST scanner checks Ruby source code against 38 security rules (including 6 Rails-specific rules). Every rule maps to a CWE and the findings span 7 OWASP Top 10 categories, and every finding comes with an explanation, a fix and a before-and-after example. Paste a file, upload a zip or connect a repository: no account, and the results stay in a private, session-isolated workspace.
Ruby, most often with Rails, favours convenience, and convenience is where mistakes creep in: mass assignment, unsafe redirects, string-interpolated SQL and dynamic code evaluation.
38 rules cover 27 distinct weakness types (11 critical, 21 high, 5 medium and 1 low severity).
| What it checks | Rules | Examples |
|---|---|---|
| Weak cryptography | 15 | MD5 used for password hashing; Null or no-op cipher used; TLS certificate validation disabled — trust all certs |
| Injection (SQL, command, code) | 4 | OS command injection in Ruby; Rails SQL built with string interpolation; ActiveRecord SQL injection via string interpolation |
| Insecure configuration | 4 | CORS: Access-Control-Allow-Credentials with wildcard origin; Rails force_ssl disabled; GraphQL introspection enabled in production |
| Hardcoded secrets | 3 | Hardcoded symmetric encryption key; JWT signed with weak or hardcoded secret; API key or token in URL query string |
| Authentication and sessions | 2 | JWT none algorithm accepted; Token or secret compared with non-constant-time equality |
| Cross-site scripting | 2 | Rails html_safe on user-controlled string; Rails raw() outputs unescaped HTML |
| Access control | 1 | Open redirect via redirect_to |
| Cross-site request forgery | 1 | Rails CSRF verification skipped |
| File handling | 1 | File upload without type or size restriction |
| Insecure deserialization | 1 | YAML.load unsafe deserialization |
| Mass assignment | 1 | Rails mass assignment permit! |
| Open redirect | 1 | Open redirect to user-controlled URL |
| Privacy and data leaks | 1 | Sensitive data written to application log |
| Server-side request forgery | 1 | SSRF — HTTP request to user-controlled URL |
Embedding #{} interpolation inside a where/find_by_sql string leads to SQL injection.
Vulnerable:
User.where("name = '#{params[:name]}'")Fixed:
User.where('name = ?', params[:name])Use parameterised queries: where('name = ?', name) or where(name: name).
Command execution via backticks / system() / exec() with untrusted input allows arbitrary command injection.
Vulnerable:
system("convert #{params[:file]} out.png")Fixed:
Open3.capture2('convert', params[:file], 'out.png')Use Open3.capture2 with an argument array and no shell string. Validate inputs against an allowlist.
YAML.load() on untrusted input executes arbitrary Ruby code via Psych gadget chains.
Vulnerable:
data = YAML.load(untrusted_input)Fixed:
data = YAML.safe_load(untrusted_input)Use YAML.safe_load() or Psych.safe_load() which restricts deserialised types to basic YAML scalars.
- uses: Rushabh5000/depwarden-action@v1
with:
sast-dir: src
sast-fail-on: high
env:
APP_API_KEY: ${{ secrets.APP_API_KEY }}DepWarden's SAST engine uses pattern rules and taint-aware rules that require untrusted input to reach a dangerous call. It is not a full cross-file dataflow engine, so a bug that only appears when data crosses several files can be missed, and every static analyser reports some false positives. Treat findings as leads: review them, fix the real ones and suppress the rest with a written reason. SAST covers the code you write; for the packages you import, run software composition analysis too.
Yes. DepWarden's Ruby scanner is free in the browser with no account: paste code, upload a zip or connect a repository. Running SAST from CI through an API key needs a plan that includes SAST.
.rb. Configuration and secret-bearing files such as .env and key files are also checked for hardcoded credentials, whatever language the project uses.
Each finding names the weakness (CWE), explains why the code is risky, shows a vulnerable and a fixed version of the pattern, and gives the remediation. Fix the code, then scan again to confirm the finding is gone.
Other languages: Python, Java, JavaScript and TypeScript, PHP, Go (Golang), C#, Kotlin, Swift, and secret scanning. Compare the options in free SAST tools compared, or start with what is SAST and SAST vs SCA.