Brakeman/RSpec Inegration

rails_helper.rb

ENV["RAILS_ENV"] ||= 'test'
require 'spec_helper'
require File.expand_path("../../config/environment", __FILE__)
require 'rspec/rails'
require 'brakeman'

ActiveRecord::Migration.maintain_test_schema!

RSpec.configure do |config|
  config.use_transactional_fixtures = true
  config.infer_spec_type_from_file_location!
  #Use this for a Rails Application
  config.after(:suite) do
    example_group = RSpec.describe('Brakeman Issues')
    example = example_group.example('must have 0 Critical Security Issues') do
      res=Brakeman.run app_path: "#{Rails.root}", output_files: ['brakeman.html']
      serious=res.warnings.count { |w| w.confidence==0 }
      puts "\n\nBrakeman Result:\n  Critical Security Issues = #{serious}"
      expect(serious).to eq 0
    end
    puts "\nBrakeman Report available here: ./brakeman.html"
    example_group.run
    passed = example.execution_result.status == :passed
    RSpec.configuration.reporter.example_failed example unless passed
  end
end

This example both runs Brakeman after all specs AND fails rspec if ANY critical (High Confidence) issues exist.

If you want to discarded ignored critical warnings, line #17 above should be something like:

  serious=res.filtered_warnings.count { |w| w.confidence==0 }