Ruby on rails security in your Continuous Integration

Foundations of your development cycle

Never send a human to do a machine’s job — Agent Smith

How open-source public tools can help improve your software security in your Continuous Integration cycle.

This presentation focus on Ruby on Rails and uses open source Ruby gems as well as Jenkins, an open source CI tool.

Two security tools are described:

• Arachni is a dynamic security analysis tool, which needs some special scripting to get integrated to Jenkins ;
• Brakeman, a static analysis tool, targets Ruby on Rails applications source code. It can be easily integrated to Jenkins thanks to an existing plug-in.

Nb: Reporting and fixed often hard to process systematically through a CI workflow