Ruby Static Code Analysis: A Developer's Guide

Q: What is RuboCop and is it just a formatter?

RuboCop is both a linter and a formatter, but the linting goes far beyond formatting. Its Lint department detects actual bugs (shadowed variables, empty rescue blocks), Metrics checks complexity, and Security checks flag dangerous method calls. The auto-correct feature handles formatting and many straightforward violations automatically.

Q: Why is Brakeman so effective for Rails apps?

Brakeman is built specifically for Rails — it understands the Rails MVC architecture, ActiveRecord query patterns, ERB rendering, and controller filters. This domain knowledge allows it to trace data flow through Rails abstractions in ways that generic tools cannot. It produces very few false positives on standard Rails code.

Q: How do I fix SQL injection in Rails?

Replace string interpolation in ActiveRecord queries with parameterized conditions. Instead of User.where("name = '#{params[:name]}'"), use User.where(name: params[:name]) or User.where("name = ?", params[:name]). Never interpolate user input into query strings.

Q: Is Sorbet worth adopting for an existing Ruby codebase?

For large codebases (50,000+ lines), yes — Sorbet catches a significant number of bugs and improves maintainability at scale. For small codebases, the setup overhead may not be justified. Sorbet supports gradual adoption: you can start with Sorbet::Typed::False (no checking) and migrate files to stricter levels incrementally.

A practical guide to static code analysis for Ruby — RuboCop, Brakeman, and how to detect security vulnerabilities in Ruby on Rails applications.

By the Hyrax team·4 min read·May 1, 2026

TL;DR

1.Ruby and Static Analysis
2.Key Ruby Static Analysis Tools
3.Common Issues Detected
4.Running Static Analysis
5.Connection to Autonomous Code Governance

Ruby and Static Analysis

Ruby's dynamic nature and the productivity-focused Rails framework have made it a popular choice for web applications. But dynamic typing, metaprogramming, and the open class model that make Ruby expressive also make it challenging to analyze statically.

The Ruby ecosystem has strong tooling for code style enforcement and Rails-specific security analysis. The combination of RuboCop (style and quality) and Brakeman (security) covers the most important analysis categories for Ruby web applications.

Key Ruby Static Analysis Tools

RuboCop

The dominant Ruby linter and formatter. Enforces the Ruby Style Guide through a comprehensive rule set organized into departments: Layout, Lint, Metrics, Naming, Performance, Security, and Style. RuboCop auto-corrects many violations with --auto-correct. Extensions add Rails-specific rules (rubocop-rails), RSpec-specific rules (rubocop-rspec), and performance analysis (rubocop-performance).

Brakeman

Purpose-built for Ruby on Rails security analysis. One of the most capable framework-specific security analyzers available for any language. Brakeman understands Rails conventions deeply — it knows how ActiveRecord, ERB templates, ActionController filters, and helper methods work, enabling precise detection of:

SQL injection in ActiveRecord queries using string interpolation
Cross-site scripting (XSS) via unescaped output in ERB templates
Mass assignment vulnerabilities (pre-4.x Rails)
Command injection via system() and backtick calls
File access vulnerabilities via user-controlled paths
Dangerous redirect handling
CSRF protection issues
Session configuration weaknesses

reek

Detects Ruby code smells: feature envy, long parameter lists, data clumps, god classes, and other structural issues. Useful for identifying code that is difficult to test or maintain.

Sorbet

A gradual type checker for Ruby developed by Stripe. Adds static type checking to Ruby through type signatures written in RBI (Ruby Interface) files or inline. Sorbet can catch type errors without running code. Most impactful for large Ruby codebases where type errors are common.

Common Issues Detected

SQL injection: User.where("name = '#{params[:name]}'") — use parameterized queries
XSS: <%= params[:user_input] %> without html_escape — use <%== or sanitize helpers
Hardcoded secrets in config files and initializers
Dangerous eval() and send() with user-controlled input
Missing CSRF protection on non-GET endpoints
Insecure mass assignment via strong parameters misconfiguration
Overly broad rescue clauses that swallow exceptions

Running Static Analysis

Ruby CI analysis pipeline:

bundle exec rubocop -- style and quality analysis
bundle exec brakeman --exit-on-warn -- fail on any security warning
bundle exec reek app/ -- code smell detection
Optionally: bundle exec sorbet tc -- type checking if Sorbet is adopted

Connection to Autonomous Code Governance

Brakeman's Rails-specific analysis makes it an excellent detection layer for autonomous remediation. SQL injection via ActiveRecord interpolation has a deterministic fix (parameterized conditions); unescaped ERB output has a clear fix (html_escape or the h() helper). Hydra integrates Brakeman findings into its remediation pipeline, generating Rails-idiomatic fixes that pass Brakeman clean and include request-spec coverage for the vulnerable endpoint.

Frequently Asked Questions

What is RuboCop and is it just a formatter?

RuboCop is both a linter and a formatter, but the linting goes far beyond formatting. Its Lint department detects actual bugs (shadowed variables, empty rescue blocks), Metrics checks complexity, and Security checks flag dangerous method calls. The auto-correct feature handles formatting and many straightforward violations automatically.

Why is Brakeman so effective for Rails apps?

Brakeman is built specifically for Rails — it understands the Rails MVC architecture, ActiveRecord query patterns, ERB rendering, and controller filters. This domain knowledge allows it to trace data flow through Rails abstractions in ways that generic tools cannot. It produces very few false positives on standard Rails code.

How do I fix SQL injection in Rails?

Replace string interpolation in ActiveRecord queries with parameterized conditions. Instead of User.where("name = '#{params[:name]}'"), use User.where(name: params[:name]) or User.where("name = ?", params[:name]). Never interpolate user input into query strings.

Is Sorbet worth adopting for an existing Ruby codebase?

For large codebases (50,000+ lines), yes — Sorbet catches a significant number of bugs and improves maintainability at scale. For small codebases, the setup overhead may not be justified. Sorbet supports gradual adoption: you can start with Sorbet::Typed::False (no checking) and migrate files to stricter levels incrementally.

Stop flagging. Start fixing.

Hyrax reviews your pull requests, remediates issues autonomously, and closes the ticket.

Join the waitlist