Static Code Analysis
Review Ruby and Rails source for CVEs and OWASP risks
Static review of Ruby source for security issues, CVEs, and OWASP risks.
overview
What dawnscanner does
Reads a Ruby project directory after checkout and writes security findings as a file and folder. Works on plain scripts; the fuller check set applies to Rails, Sinatra, and Padrino apps.
Pass the target directory, then narrow with -d for Gemfile.lock CVE matching only, or disable categories with --disable-cve-bulletins, --disable-owasp-top-10, and --disable-code-style.
Prefer this when the repo is Ruby-first. For polyglot trees, pair it with semgrep and merge findings; dawnscanner stays the Rails-aware specialist rather than a multi-language SAST.
use cases
Where dawnscanner fits
Scan a Ruby app for security issues
Point dawnscanner at a Rails or Sinatra project directory and it reviews the source against its security rule set for the major MVC frameworks.
Check dependencies for known CVEs
Run the dependencies-only mode with -d so it cross-references Gemfile.lock against CVE bulletins and flags vulnerable gems.
Focus on OWASP Top 10 risks
Disable code-style and code-quality checks to keep a run on the OWASP and CVE findings that matter for a security review.
Unify static and dynamic findings
Route dawnscanner results into the same table and triage flow as scanner output for one view of risk across code and runtime.
reference
dawnscanner inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| target-dir | FOLDER | · | Target directory of Ruby source to scan. |
| dependencies | BOOLEAN | -d | Scan only for vulnerabilities affecting the gems pinned in Gemfile.lock. |
| disable-cve-bulletins | BOOLEAN | --disable-cve-bulletins | Disable all CVE security checks. |
| disable-owasp-top-10 | BOOLEAN | --disable-owasp-top-10 | Disable all OWASP Top 10 checks. |
| disable-owasp-ror-cheatsheet | BOOLEAN | --disable-owasp-ror-cheatsheet | Disable all OWASP Ruby on Rails cheatsheet checks. |
| disable-code-style | BOOLEAN | --disable-code-style | Disable all code style checks. |
Showing key inputs. dawnscanner exposes 7 inputs in total.
Full flag reference (7 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| target-dir | FOLDER | · | Target directory of Ruby source to scan. |
| dependencies | BOOLEAN | -d | Scan only for vulnerabilities affecting the gems pinned in Gemfile.lock. |
| disable-code-style | BOOLEAN | --disable-code-style | Disable all code style checks. |
| disable-owasp-top-10 | BOOLEAN | --disable-owasp-top-10 | Disable all OWASP Top 10 checks. |
| disable-cve-bulletins | BOOLEAN | --disable-cve-bulletins | Disable all CVE security checks. |
| disable-code-quality-checks | BOOLEAN | --disable-code-quality | Disable all code quality checks. |
| disable-owasp-ror-cheatsheet | BOOLEAN | --disable-owasp-ror-cheatsheet | Disable all OWASP Ruby on Rails cheatsheet checks. |
example
Run dawnscanner
# review a Rails app for security, drop the style and quality noisedawn --disable-code-style --disable-code-quality ./example-rails-app[*] dawn v2.2.1 is starting up[$] dawn: scanning ./example-rails-app[$] dawn: rails mvc web framework detected[$] dawn: 246 security checks applied - 3 vulnerabilities found[!] dawn: CVE-2022-32224 possible RCE via serialized columns in Active Record (critical)[!] dawn: CVE-2023-22795 ReDoS based DoS in Action Dispatch routing (high)[!] dawn: CVE-2024-26143 XSS in Action Controller translation helpers (medium)[$] dawn: 3 findings mapped to OWASP Top 10 and CVE bulletins[$] dawn: scan completed in 1.87 secondsguidance
Choosing dawnscanner
Use when the target is Ruby source, especially a Rails or Sinatra app, and you want security, CVE, and OWASP checks in one pass. For multi-language static analysis, semgrep covers more ground; dawnscanner is the Ruby-aware specialist.
semgrep
Pattern-based static analysis across many languages. Broader than dawnscanner Ruby focus.
bandit
Python security linter. Language-specific depth on the Python side of a polyglot pipeline.
gosec
Go security scanner. Another language-specific static analyzer for mixed repos.
faq
dawnscanner questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run dawnscanner yourself
Ruby source feeds dawnscanner, which reviews it against OWASP, CVE, and quality checks and writes the security findings as a queryable output.
Facts on this page come from the live Trickest tool library.