> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Brakeman

> CodeRabbit runs Brakeman to identify security vulnerabilities in Ruby on Rails applications.

[Brakeman](https://brakemanscanner.org/) is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities. It scans your application's code for potential security issues and provides detailed reports; CodeRabbit runs Brakeman version 8.0.6.

## Files

Brakeman will run when a pull request changes files with the following names and extensions:

* `Gemfile`
* `*.rb`
* `*.erb`

## Configuration

Brakeman is enabled by default. Enable or disable it with `.coderabbit.yaml` or the CodeRabbit web UI:

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        brakeman:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → Brakeman** in your organization or repository settings and toggle Brakeman `on` or `off`.
  </Tab>
</Tabs>

## Security policy and restrictions

CodeRabbit runs Brakeman in a sandbox with its built-in checks. Repository-provided external checks and Ruby check bundles are not loaded.

## When we skip Brakeman

CodeRabbit will skip running Brakeman when:

* No Rails files are found in the pull request.
* Brakeman is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

## Features

Brakeman can detect many critical vulnerabilities such as:

* SQL injection
* Cross-site scripting (XSS)
* Mass assignment
* Remote code execution
* And many more security vulnerabilities
* Out of date package versions
* Etc

## Links

* [Brakeman Official Website](https://brakemanscanner.org/)
* [Brakeman GitHub Repository](https://github.com/presidentbeef/brakeman)
* [Brakeman Documentation](https://brakemanscanner.org/docs/)
* [Warning Types](https://brakemanscanner.org/docs/warning_types/)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.