Brakeman Report Visualizer

How to generate a Brakeman JSON report

Brakeman (opens in new window) is a static analysis security scanner for Ruby on Rails applications. It reads your source code without running it, so it can be used from the very first line of code.

1. Install the gem globally, or add it to the development group of your Gemfile (Rails 7.2+ applications ship with it by default):

   gem install brakeman

2. From the root of your Rails application, run a scan and write the results to a JSON file. The format is inferred from the .json extension:

   brakeman -o brakeman-report.json

3. Drop brakeman-report.json into the upload area above, or click Browse File.

Useful variants for CI pipelines and existing projects:

# With Bundler, forcing the JSON format and a quiet output
bundle exec brakeman -q -f json -o brakeman-report.json

# Write the report without failing the build when warnings are found
brakeman -o brakeman-report.json --no-exit-on-warn

# Review warnings interactively and mute false positives in config/brakeman.ignore
brakeman -I

Compare scans and triage warnings

The built-in brakeman -o report.html output is a static list. This dashboard adds the triage loop around it:

1. Compare with a previous scan. Load the report of your main branch or of the last release as a baseline. Every warning is tagged new, unchanged or fixed. Brakeman fingerprints do not depend on line numbers, so code that only moved is not reported as new.

   # On main
   brakeman -q --no-exit-on-warn -o baseline.json
   # On your branch
   brakeman -q --no-exit-on-warn -o brakeman-report.json

2. Triage each warning. Open a warning and set its status: To fix, False positive or Accepted risk, with a note explaining why, and its severity for your application. The location (Controller#action), the user input highlighted in the code snippet and the CWE / OWASP Top 10:2025 category help you decide. Set Links to your code to open each file at the right line in VS Code or on GitHub / GitLab.

   Narrow the list by type, folder or triage status and sort it by severity or by file. The filters are kept in the page address, so a view can be bookmarked; the part of the address holding them is never sent to any server.

3. Export config/brakeman.ignore. False positives and accepted risks are written in Brakeman's own ignore format, with your note as justification. Brakeman's JSON report does not include the notes of already ignored warnings, so load your current config/brakeman.ignore first: its entries and notes are kept as they are in the export.

   # Replace the ignore file, review the diff, commit it
   mv ~/Downloads/brakeman.ignore config/brakeman.ignore
   git diff config/brakeman.ignore

100% client-side privacy guarantee

Security reports reveal file paths, code snippets and weaknesses of your application. Unlike hosted platforms, this visualizer has no backend, so you can use it on confidential client projects:

• Zero report data sent to any server: the file is read with the browser FileReader API and never uploaded, stored or logged.
• All parsing happens locally: JSON parsing, scoring, filtering and remediation guidance run entirely in JavaScript on your device.
• The report never persists: reports, baselines and ignore files are never written to cookies or browser storage. Closing or reloading the tab clears them from memory.
• Only your triage decisions are kept, in this browser: the status, severity and note you give a warning are saved in local storage, keyed by the warning fingerprint (a hash computed by Brakeman). They are dropped once the warning appears in config/brakeman.ignore. Use Reset triage to delete them all. The code link setting (editor and project path or repository URL) is saved the same way.
• Exports are generated locally: the brakeman.ignore file is built in JavaScript and downloaded straight from the page.
• Verifiable: once the page is loaded, you can disconnect from the network and the dashboard keeps working.

Understanding confidence levels and the Security Index

Brakeman assigns a confidence level to each warning. It expresses how certain Brakeman is that the warning is a real vulnerability, not how severe the vulnerability would be.

High

User input flows directly into a dangerous method, for example params interpolated into a SQL query. Treat it as a confirmed issue and fix it first.

Medium

A dangerous pattern uses a value that is probably, but not certainly, user-controlled, such as a model attribute rendered without escaping. Review it carefully.

Weak

A risky construct was found but Brakeman could not link it to user input. It is often a false positive, yet still worth a quick review.

How the Security Index is calculated

The Security Index starts at 100 and deducts points for each active warning. Warnings muted in config/brakeman.ignore and warnings you triaged as false positive are listed but not scored. The score never drops below 0.

Confidence is not severity: when you set a severity on a warning during triage, it replaces the confidence in the calculation.

Common Rails vulnerabilities detected by Brakeman

Brakeman also detects open redirects, dynamic render paths, unsafe file access and many more. See the full list of Brakeman warning types (opens in new window).

Frequently asked questions