Updated Jul 14, 2026

Static Code Analysis

Review Ruby and Rails source for CVEs and OWASP risks

Static review of Ruby source for security issues, CVEs, and OWASP risks.

Agent

overview

What dawnscanner does

Reads a Ruby project directory after checkout and writes security findings as a file and folder. Works on plain scripts; the fuller check set applies to Rails, Sinatra, and Padrino apps.

Pass the target directory, then narrow with -d for Gemfile.lock CVE matching only, or disable categories with --disable-cve-bulletins, --disable-owasp-top-10, and --disable-code-style.

Prefer this when the repo is Ruby-first. For polyglot trees, pair it with semgrep and merge findings; dawnscanner stays the Rails-aware specialist rather than a multi-language SAST.

source github.com/thesp0nge/dawnscanner

use cases

Where dawnscanner fits

Scan a Ruby app for security issues

Point dawnscanner at a Rails or Sinatra project directory and it reviews the source against its security rule set for the major MVC frameworks.

Check dependencies for known CVEs

Run the dependencies-only mode with -d so it cross-references Gemfile.lock against CVE bulletins and flags vulnerable gems.

Focus on OWASP Top 10 risks

Disable code-style and code-quality checks to keep a run on the OWASP and CVE findings that matter for a security review.

Unify static and dynamic findings

Route dawnscanner results into the same table and triage flow as scanner output for one view of risk across code and runtime.

reference

dawnscanner inputs and flags

7 inputs
NameTypeFlagDescription
target-dirFOLDER·Target directory of Ruby source to scan.
dependenciesBOOLEAN-dScan only for vulnerabilities affecting the gems pinned in Gemfile.lock.
disable-cve-bulletinsBOOLEAN--disable-cve-bulletinsDisable all CVE security checks.
disable-owasp-top-10BOOLEAN--disable-owasp-top-10Disable all OWASP Top 10 checks.
disable-owasp-ror-cheatsheetBOOLEAN--disable-owasp-ror-cheatsheetDisable all OWASP Ruby on Rails cheatsheet checks.
disable-code-styleBOOLEAN--disable-code-styleDisable all code style checks.

Showing key inputs. dawnscanner exposes 7 inputs in total.

Full flag reference (7 inputs)
NameTypeFlagDescription
target-dirFOLDER·Target directory of Ruby source to scan.
dependenciesBOOLEAN-dScan only for vulnerabilities affecting the gems pinned in Gemfile.lock.
disable-code-styleBOOLEAN--disable-code-styleDisable all code style checks.
disable-owasp-top-10BOOLEAN--disable-owasp-top-10Disable all OWASP Top 10 checks.
disable-cve-bulletinsBOOLEAN--disable-cve-bulletinsDisable all CVE security checks.
disable-code-quality-checksBOOLEAN--disable-code-qualityDisable all code quality checks.
disable-owasp-ror-cheatsheetBOOLEAN--disable-owasp-ror-cheatsheetDisable all OWASP Ruby on Rails cheatsheet checks.

example

Run dawnscanner

dawnscanner · command
# review a Rails app for security, drop the style and quality noisedawn --disable-code-style --disable-code-quality ./example-rails-app
sample output
[*] dawn v2.2.1 is starting up[$] dawn: scanning ./example-rails-app[$] dawn: rails mvc web framework detected[$] dawn: 246 security checks applied - 3 vulnerabilities found[!] dawn: CVE-2022-32224 possible RCE via serialized columns in Active Record (critical)[!] dawn: CVE-2023-22795 ReDoS based DoS in Action Dispatch routing (high)[!] dawn: CVE-2024-26143 XSS in Action Controller translation helpers (medium)[$] dawn: 3 findings mapped to OWASP Top 10 and CVE bulletins[$] dawn: scan completed in 1.87 seconds

guidance

Choosing dawnscanner

Use when the target is Ruby source, especially a Rails or Sinatra app, and you want security, CVE, and OWASP checks in one pass. For multi-language static analysis, semgrep covers more ground; dawnscanner is the Ruby-aware specialist.

semgrep

Pattern-based static analysis across many languages. Broader than dawnscanner Ruby focus.

bandit

Python security linter. Language-specific depth on the Python side of a polyglot pipeline.

gosec

Go security scanner. Another language-specific static analyzer for mixed repos.

faq

dawnscanner questions

Ruby source. It parses the project, detects the MVC framework, and matches code against OWASP Top 10, the OWASP Ruby on Rails cheatsheet, known CVEs, and code quality and style rules.

Run dawnscanner yourself

Ruby source feeds dawnscanner, which reviews it against OWASP, CVE, and quality checks and writes the security findings as a queryable output.

Facts on this page come from the live Trickest tool library.