Rails 8: Brakeman added as default

Rails 8 adds Brakeman as default

As of February 2024, new applications using Rails 8 have Brakeman by default.

For previous Rails versions, you can install Brakeman using RubyGems, Bundler, or Docker:

```
RubyGems: gem install brakeman
```

Bundler: group :development do 
          gem 'brakeman' 
         end

Docker: docker pull presidentbeef/brakeman

What is Brakeman?

Brakeman is a security scanning tool specifically designed for Ruby on Rails applications. It's an open-source static analysis tool that scans Rails application code to identify potential security vulnerabilities, security weaknesses, and other issues that could lead to security breaches.

Here's how Brakeman works and what it can do:

Static Analysis: Brakeman performs static analysis on Rails application code. This means it examines the code without executing it, looking for patterns and structures that indicate potential security problems.
Detection of Vulnerabilities: Brakeman is capable of detecting a wide range of security vulnerabilities and weaknesses, including but not limited to:

- SQL Injection vulnerabilities
- Cross-Site Scripting (XSS) vulnerabilities
- Cross-Site Request Forgery (CSRF) vulnerabilities
- Mass Assignment vulnerabilities
- Remote Code Execution vulnerabilities
- Insecure Direct Object References (IDOR)
- Security configuration issues
- and more.
Reporting: After analyzing the codebase, Brakeman generates a detailed report listing all identified security issues, along with information about where in the code each issue was found. The report typically includes severity levels for each issue to help prioritize fixes.
Integration: Brakeman can be integrated into the development workflow of a Rails application, such as through Continuous Integration (CI) systems like Jenkins or GitLab CI. This allows developers to automatically scan their code for security issues as part of the development and testing process.
Customization: Brakeman provides options for customization, allowing developers to configure the tool according to their specific requirements and preferences. This includes options for excluding certain paths or files from the analysis, adjusting severity levels, and more.

Overall, Brakeman is a valuable tool for Rails developers to proactively identify and address security vulnerabilities in their applications, helping to improve the overall security posture and reduce the risk of security breaches. It's considered a standard part of the security toolkit for Rails development teams.