Free Ruby SAST scanner: find security bugs in Ruby code
DepWarden's free Ruby SAST scanner checks Ruby source code against 38 security rules (including 6 Rails-specific rules). Every rule maps to a CWE and the findings span 7 OWASP Top 10 categories, and every finding comes with an explanation, a fix and a before-and-after example. Paste a file, upload a zip or connect a repository: no account, and the results stay in a private, session-isolated workspace.
Ruby, most often with Rails, favours convenience, and convenience is where mistakes creep in: mass assignment, unsafe redirects, string-interpolated SQL and dynamic code evaluation.
What DepWarden checks in Ruby code
38 rules cover 27 distinct weakness types (11 critical, 21 high, 5 medium and 1 low severity).
| What it checks | Rules | Examples |
|---|---|---|
| Weak cryptography | 15 | MD5 used for password hashing; Null or no-op cipher used; TLS certificate validation disabled — trust all certs |
| Injection (SQL, command, code) | 4 | OS command injection in Ruby; Rails SQL built with string interpolation; ActiveRecord SQL injection via string interpolation |
| Insecure configuration | 4 | CORS: Access-Control-Allow-Credentials with wildcard origin; Rails force_ssl disabled; GraphQL introspection enabled in production |
| Hardcoded secrets | 3 | Hardcoded symmetric encryption key; JWT signed with weak or hardcoded secret; API key or token in URL query string |
| Authentication and sessions | 2 | JWT none algorithm accepted; Token or secret compared with non-constant-time equality |
| Cross-site scripting | 2 | Rails html_safe on user-controlled string; Rails raw() outputs unescaped HTML |
| Access control | 1 | Open redirect via redirect_to |
| Cross-site request forgery | 1 | Rails CSRF verification skipped |
| File handling | 1 | File upload without type or size restriction |
| Insecure deserialization | 1 | YAML.load unsafe deserialization |
| Mass assignment | 1 | Rails mass assignment permit! |
| Open redirect | 1 | Open redirect to user-controlled URL |
| Privacy and data leaks | 1 | Sensitive data written to application log |
| Server-side request forgery | 1 | SSRF — HTTP request to user-controlled URL |
Examples from the Ruby rules
Rails SQL built with string interpolation (CWE-89, critical)
Embedding #{} interpolation inside a where/find_by_sql string leads to SQL injection.
Vulnerable:
User.where("name = '#{params[:name]}'")Fixed:
User.where('name = ?', params[:name])Use parameterised queries: where('name = ?', name) or where(name: name).
OS command injection in Ruby (CWE-78, critical)
Command execution via backticks / system() / exec() with untrusted input allows arbitrary command injection.
Vulnerable:
system("convert #{params[:file]} out.png")Fixed:
Open3.capture2('convert', params[:file], 'out.png')Use Open3.capture2 with an argument array and no shell string. Validate inputs against an allowlist.
YAML.load unsafe deserialization (CWE-502, critical)
YAML.load() on untrusted input executes arbitrary Ruby code via Psych gadget chains.
Vulnerable:
data = YAML.load(untrusted_input)Fixed:
data = YAML.safe_load(untrusted_input)Use YAML.safe_load() or Psych.safe_load() which restricts deserialised types to basic YAML scalars.
Run it
- Paste code: open the SAST scanner, choose Ruby and paste a file. You get findings in seconds.
- Upload a zip: files with these extensions are scanned: .rb. Dependency folders such as node_modules and vendor are skipped.
- Connect a repo: point DepWarden at a branch and it scans it once or on a schedule, with an emailed report.
- In CI: the GitHub Action runs SAST as its own step and can fail the build on severity. CI use goes through an API key and needs a plan that includes SAST.
- uses: Rushabh5000/depwarden-action@v1
with:
sast-dir: src
sast-fail-on: high
env:
APP_API_KEY: ${{ secrets.APP_API_KEY }}What it does not do
DepWarden's SAST engine uses pattern rules and taint-aware rules that require untrusted input to reach a dangerous call. It is not a full cross-file dataflow engine, so a bug that only appears when data crosses several files can be missed, and every static analyser reports some false positives. Treat findings as leads: review them, fix the real ones and suppress the rest with a written reason. SAST covers the code you write; for the packages you import, run software composition analysis too.
Frequently asked questions
Is there a free Ruby SAST tool?
Yes. DepWarden's Ruby scanner is free in the browser with no account: paste code, upload a zip or connect a repository. Running SAST from CI through an API key needs a plan that includes SAST.
Which Ruby files are scanned?
.rb. Configuration and secret-bearing files such as .env and key files are also checked for hardcoded credentials, whatever language the project uses.
How do I fix what it finds?
Each finding names the weakness (CWE), explains why the code is risky, shows a vulnerable and a fixed version of the pattern, and gives the remediation. Fix the code, then scan again to confirm the finding is gone.
More
Other languages: Python, Java, JavaScript and TypeScript, PHP, Go (Golang), C#, Kotlin, Swift, and secret scanning. Compare the options in free SAST tools compared, or start with what is SAST and SAST vs SCA.