loading
Loading content
loading
Static Code Analysis
Static review of Ruby source for security issues, CVEs, and OWASP risks.
overview
Reads a Ruby project directory after checkout and writes security findings as a file and folder. Works on plain scripts; the fuller check set applies to Rails, Sinatra, and Padrino apps.
Pass the target directory, then narrow with -d for Gemfile.lock CVE matching only, or disable categories with --disable-cve-bulletins, --disable-owasp-top-10, and --disable-code-style.
Prefer this when the repo is Ruby-first. For polyglot trees, pair it with semgrep and merge findings; dawnscanner stays the Rails-aware specialist rather than a multi-language SAST.
use cases
Point dawnscanner at a Rails or Sinatra project directory and it reviews the source against its security rule set for the major MVC frameworks.
Run the dependencies-only mode with -d so it cross-references Gemfile.lock against CVE bulletins and flags vulnerable gems.
Disable code-style and code-quality checks to keep a run on the OWASP and CVE findings that matter for a security review.
Route dawnscanner results into the same table and triage flow as scanner output for one view of risk across code and runtime.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-dir | FOLDER | · | Target directory of Ruby source to scan. |
| dependencies | BOOLEAN | -d | Scan only for vulnerabilities affecting the gems pinned in Gemfile.lock. |
| disable-cve-bulletins | BOOLEAN | --disable-cve-bulletins | Disable all CVE security checks. |
| disable-owasp-top-10 | BOOLEAN | --disable-owasp-top-10 | Disable all OWASP Top 10 checks. |
| disable-owasp-ror-cheatsheet | BOOLEAN | --disable-owasp-ror-cheatsheet | Disable all OWASP Ruby on Rails cheatsheet checks. |
| disable-code-style | BOOLEAN | --disable-code-style | Disable all code style checks. |
Showing key inputs. dawnscanner exposes 7 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| target-dir | FOLDER | · | Target directory of Ruby source to scan. |
| dependencies | BOOLEAN | -d | Scan only for vulnerabilities affecting the gems pinned in Gemfile.lock. |
| disable-code-style | BOOLEAN | --disable-code-style | Disable all code style checks. |
| disable-owasp-top-10 | BOOLEAN | --disable-owasp-top-10 | Disable all OWASP Top 10 checks. |
| disable-cve-bulletins | BOOLEAN | --disable-cve-bulletins | Disable all CVE security checks. |
| disable-code-quality-checks | BOOLEAN | --disable-code-quality | Disable all code quality checks. |
| disable-owasp-ror-cheatsheet | BOOLEAN | --disable-owasp-ror-cheatsheet | Disable all OWASP Ruby on Rails cheatsheet checks. |
example
# review a Rails app for security, drop the style and quality noisedawn --disable-code-style --disable-code-quality ./example-rails-app[*] dawn v2.2.1 is starting up[$] dawn: scanning ./example-rails-app[$] dawn: rails mvc web framework detected[$] dawn: 246 security checks applied - 3 vulnerabilities found[!] dawn: CVE-2022-32224 possible RCE via serialized columns in Active Record (critical)[!] dawn: CVE-2023-22795 ReDoS based DoS in Action Dispatch routing (high)[!] dawn: CVE-2024-26143 XSS in Action Controller translation helpers (medium)[$] dawn: 3 findings mapped to OWASP Top 10 and CVE bulletins[$] dawn: scan completed in 1.87 secondsguidance
Use when the target is Ruby source, especially a Rails or Sinatra app, and you want security, CVE, and OWASP checks in one pass. For multi-language static analysis, semgrep covers more ground; dawnscanner is the Ruby-aware specialist.
Pattern-based static analysis across many languages. Broader than dawnscanner Ruby focus.
Python security linter. Language-specific depth on the Python side of a polyglot pipeline.
Go security scanner. Another language-specific static analyzer for mixed repos.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
Ruby source feeds dawnscanner, which reviews it against OWASP, CVE, and quality checks and writes the security findings as a queryable output.
Facts on this page come from the live Trickest tool library.