Scryer

Ruby & Rails Code Security Auditor — one audit command instead of RuboCop + Brakeman + bundler-audit + Reek + custom scripts.

gem install scryer MIT licensed zero runtime deps

Scryer scans Ruby and Rails source for security vulnerabilities, performance problems, duplicate/smelly code, and dependency vulnerabilities — in one scan, with one report. Built on Ruby's own stdlib Ripper parser, so the static scan needs no Rails or Bundler to run at all.

gem install scryer
scryer

Scryer Audit — 236 files scanned
────────────────────────────────

Security                8 findings
Performance            10 findings
Code Quality          248 findings
Dependencies           24 findings
────────────────────────────────
Total                 290 findings

JSON report: tmp/scryer_report.json
HTML report: tmp/scryer_report.html

That's real output from a scan of a live 236-file Rails app, not a mockup.

What it detects

• Security — SQL injection, mass assignment, command injection, hardcoded secrets, unsafe deserialization, XSS-prone HTML, CSRF gaps, weak crypto, open redirects.
• Performance — N+1 queries, missing pagination, inefficient per-record saves, unbounded full-table iteration.
• Code quality — near-duplicate code across methods (token-normalized similarity), plus one narrow style check: a missing frozen_string_literal magic comment.
• Dependencies — known-vulnerable gem versions (live OSV.dev query) and insecure Gemfile.lock sources, on by default.
• Runtime — an opt-in ActiveRecord query watcher for N+1s and unused eager loading as they actually happen.

How it compares

Capability	Scryer	RuboCop	Brakeman	bundler-audit
Style/lint conventions	Partial*	✅	❌	❌
Rails security scanning	✅	❌	✅	❌
Performance heuristics	✅	Partial	❌	❌
Duplicate code detection	✅	Partial	❌	❌
Dependency vulnerabilities	✅	❌	❌	✅
Runtime query analysis	✅	❌	❌	❌
Single command, all of the above	✅	❌	❌	❌

* One narrow check only (a missing frozen_string_literal magic comment) — everything else in RuboCop's domain is intentionally out of scope. Full breakdown with footnotes in the README.

Links