Brakeman

We use Brakeman on GitHub Actions to alert us to security vulnerabilities in pull requests. You can use Brakeman locally to preview and action the results of this scan.

GitHub Actions' code scanning does not follow Brakeman's `.ignore` file. GitHub supports SARIF, but not the suppressed annotations output by Brakeman.

To ignore warnings (e.g. known safe methods that can be skipped by XSS checks), you can update Brakeman's options in config/brakeman.yml.