brakeman shell script

brakeman.bash

#!/bin/bash
#   _                        _
#  | |__      _ _   __ _    | |__    ___    _ __    __ _    _ _
#  | '_ \    | '_| / _` |   | / /   / -_)  | '  \  / _` |  | ' \
#  |_.__/   _|_|_  \__,_|   |_\_\   \___|  |_|_|_| \__,_|  |_||_|
# _|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|
# "`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'
#
# Script for running Brakeman tests
# Brakeman is a security scanner https://github.com/presidentbeef/brakeman.
#
# based on: https://semaphoreci.com/community/tutorials/automatic-security-testing-of-rails-applications-using-brakeman

# install brakeman from scratch every time. Brakeman is regularly updated with new security checks.
# A fresh install thus ensures that you have the latest version every time the checks are performed
gem install -N brakeman

# run brakeman with -I to generate/update the `brakeman.ignore` file, which should be checked into version control.
# TODO: IMPORTANT! reduce confidence level and fix/ignore lower level warnings, eventually remove that flag.
brakeman --ignore-config brakeman.ignore --exit-on-warn --confidence-level 3 --github-repo YOUR_ORG/YOUR_REPO -o ./artifacts/brakeman.md -o ./artifacts/brakeman.html