awesome-ruby-security

Articles & Guides

Rails Security Guides - The essentials to read when dealing with Rails Applications.
Securing Rails Application from developers perspective - A detailed blog on Ruby on Rails security from developers perspective that contains OWASP Top & other application issues with fixes / recommendation and fix codes.
Rails security checklist - 🔑 Community-driven Rails Security Checklist.
Zen Rails Security Checklist - A well-documented Rails security checklist.
Rails security best practices - A good overview of usefull things to look out for when working with Rails.
Rubyfu - Offensive security book for rubyist (Source)
Securing Ruby and Rails Apps - Applying static code analysis and dependency checking in your CI/CD pipeline.
OWASP Ruby on Rails Cheatsheet - This Cheatsheet intends to provide quick basic Ruby on Rails security tips for developers. It complements, augments or emphasizes points brought up in the rails security guide from rails core.
Attacking Ruby on Rails Applications - Phrack article by joernchen on finding security vulnerabilities in Rails applications.

RailsGoat - A vulnerable version of Rails that follows the OWASP Top 10 http://railsgoat.cktricky.com .
DeleteMe - Educational insecure Rails application.

Ronin - Ronin is a free and Open Source Ruby toolkit for security research and development.
Salus - Multi purpose security scanning tool supporting Ruby, Node, Python and Go.
Snyk - Continuously and automatically finds & fixes vulnerabilities for Ruby and other languages.

Security for Developers - Newsletter catering towards developers and covering many languages.

Rails Application Routes Parser - A script that print out ruby on rails application routes/URLs.
brakeman - A static analysis security vulnerability scanner for Ruby on Rails applications.
rubocop-gitlab-security - A set of rules to extend rubocop with additional security rules.
dawnscanner - A static analysis security scanner for ruby applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
git-secrets - Prevents you from committing secrets and credentials into git repositories.
DevSkim - DevSkim is a set of IDE plugins and rules that provide security "linting" capabilities. Also has support for CLI so it can be integrated into CI/CD pipeline.
ban-sensitive-files - Checks filenames to be committed against a library of filename rules to prevent storing sensitive files in Git. Checks some files for sensitive contents (for example authToken inside .npmrc file).
rails_best_practices - A static code analyzer for Ruby on Rails applications that finds - among other things - common patterns that might lead to security vulnerabilities.
Bearer - A code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

bundler-audit - Patch-level verification for Ruby apps.
ruby-advisory-db - Open source database of security advisories that are relevant to Ruby libraries.
GemScanner - GemScanner identifies depreciated versions of gems in your ruby on rails project.

secure-headers - Manages application of security headers with many safe defaults.
Rack::Attack - Middleware for blocking and throttling requests.