Brakeman Report Visualizer

Inspect Brakeman scan reports directly in your browser. All analysis runs locally — no report data is sent to any server.

Drag & Drop your report

Or select your local brakeman-report.json or Brakeman output file.

No report at hand? The sample report lets you explore the dashboard right away.

Report Dashboard

Total Warnings

0

High Confidence

0

Medium Confidence

0

Weak Confidence

0

Security Index

A+

Excellent posture

100%
Scan Date: N/A
Rails: N/A
Brakeman: N/A
Duration: N/A

Identified Vulnerabilities

0 found

Guide: Visualizing Brakeman Security Reports

How to generate a Brakeman JSON report

Brakeman (opens in new window) is a static analysis security scanner for Ruby on Rails applications. It reads your source code without running it, so it can be used from the very first line of code.

  1. Install the gem globally, or add it to the development group of your Gemfile (Rails 7.2+ applications ship with it by default):

    gem install brakeman

  2. From the root of your Rails application, run a scan and write the results to a JSON file. The format is inferred from the .json extension:

    brakeman -o brakeman-report.json

  3. Drop brakeman-report.json into the upload area above, or click Browse File.

Useful variants for CI pipelines and existing projects:

# With Bundler, forcing the JSON format and a quiet output
bundle exec brakeman -q -f json -o brakeman-report.json

# Write the report without failing the build when warnings are found
brakeman -o brakeman-report.json --no-exit-on-warn

# Review warnings interactively and mute false positives in config/brakeman.ignore
brakeman -I

100% client-side privacy guarantee

Security reports reveal file paths, code snippets and weaknesses of your application. They should never be shared with a third-party service. This visualizer was designed accordingly:

  • Zero report data sent to any server: the file is read with the browser FileReader API and never uploaded, stored or logged.
  • All parsing happens locally: JSON parsing, scoring, filtering and remediation guidance run entirely in JavaScript on your device.
  • Nothing persists: the report is never written to cookies or local storage. Closing or reloading the tab clears it from memory.
  • Verifiable: once the page is loaded, you can disconnect from the network and the dashboard keeps working.

Understanding confidence levels and the Security Index

Brakeman assigns a confidence level to each warning. It expresses how certain Brakeman is that the warning is a real vulnerability, not how severe the vulnerability would be.

High
User input flows directly into a dangerous method, for example params interpolated into a SQL query. Treat it as a confirmed issue and fix it first.
Medium
A dangerous pattern uses a value that is probably, but not certainly, user-controlled, such as a model attribute rendered without escaping. Review it carefully.
Weak
A risky construct was found but Brakeman could not link it to user input. It is often a false positive, yet still worth a quick review.

How the Security Index is calculated

The Security Index starts at 100 and deducts points for each active warning. Warnings muted in config/brakeman.ignore are listed but not scored, as they were reviewed by your team. The score never drops below 0.

Points deducted per active warning
Confidence Deduction
High−10 points
Medium−4 points
Weak−1 point
Grades associated with the score
Score Grade Meaning
95 – 100A+Excellent posture
90 – 94AVery secure
80 – 89BMinor warnings
70 – 79CAction required
50 – 69DVulnerable profile
0 – 49FCritical issues present

Common Rails vulnerabilities detected by Brakeman

SQL Injection

User input interpolated into ActiveRecord query strings, like where("name = '#{params[:name]}'"). Use hash conditions or ? placeholders instead.

Remote Code Execution

User-controlled values passed to eval, constantize or unsafe deserialization, allowing attackers to run arbitrary Ruby code on the server.

Mass Assignment

Request parameters assigned to models without Strong Parameters, or with permit!, letting attackers overwrite attributes they should not control.

Cross-Site Scripting (XSS)

Unescaped output in views through raw or html_safe, enabling script injection into your users' browsers.

Command Injection

User parameters passed to system, exec, %x or Open3 without shell escaping, letting attackers run arbitrary operating system commands. Pass arguments as an array instead of a single string.

Brakeman also detects open redirects, dynamic render paths, unsafe file access and many more. See the full list of Brakeman warning types (opens in new window).

Frequently asked questions

Is my Brakeman report uploaded to a server?

No. The report is read and parsed entirely in your browser. No report data is sent to any server, stored or logged.

Which Brakeman output format does the visualizer accept?

The visualizer accepts the standard Brakeman JSON report, generated with brakeman -o brakeman-report.json or brakeman -f json. The file must contain a warnings or ignored_warnings array.

How are ignored warnings handled?

Warnings muted in config/brakeman.ignore appear under the Ignored filter with their justification note. They are excluded from the confidence counters and the Security Index.

Is Brakeman confidence the same as severity?

No. Confidence indicates how likely a warning is to be a real issue. A Weak confidence SQL injection can still be critical if it turns out to be exploitable.

Does a perfect Security Index mean my Rails application is secure?

No. Brakeman is a static analysis tool: it cannot detect business logic flaws, misconfigured infrastructure or vulnerable dependencies. Combine it with bundler-audit, code reviews and penetration testing.

Can I try the dashboard without a report?

Yes. Click Load Sample Report to open a realistic example report with High, Medium and Weak confidence warnings, plus an ignored warning.