Adding Scryer - An all-in-one security auditing and static analysis t…

[ramlaxmanyadav]

Project

**Scryer is an all-in-one security auditing and static analysis tool for Ruby on Rails applications. **
GitHub: https://github.com/ramlaxmanyadav/scryer
RubyGems: https://rubygems.org/gems/scryer
Project page / docs: https://ramlaxmanyadav.github.io/scryer/

What is this Ruby project?

Scryer is an all-in-one security auditing and static analysis tool for Ruby on Rails applications. Rather than answering "what's wrong" the way a single-purpose linter does, it answers "what's actually worth fixing first" — it scans across four categories in one pass and ranks everything by severity together, not as four separate reports to reconcile by hand:

Security — 31 rules covering SQL injection, mass assignment, SSRF, path traversal, IDOR, missing authorization, insecure JWT/CORS/session/cookie config, hardcoded secrets, XSS, weak crypto, unsafe deserialization, open redirects, and more. Every finding carries a CWE ID and an OWASP Top 10 (2021) category.
Performance — N+1 query detection, missing pagination, unbounded table scans, inefficient save loops.
Dependencies — live vulnerable-gem lookups against OSV.dev, insecure git/http Gemfile sources, Ruby EOL checks, exposed config/master.key detection.
Code quality — near-duplicate/similar code detection across methods, queries, and cache keys via token-normalized similarity.

What are the main differences between this Ruby project and similar ones?

• vs. Brakeman — Brakeman does real taint/data-flow analysis for Rails security specifically, with years of maturity Scryer's heuristic pattern-matching doesn't try to match. Scryer's checks trade some precision (real false-positive risk, especially on idor) for breadth: it also covers performance, dependencies, and code quality, and combines all four into one ranked list, which Brakeman doesn't attempt.
• vs. RuboCop — RuboCop owns style/lint entirely (naming, layout, quote style, hundreds of cops); Scryer intentionally stays out of that territory except one narrow check (missing frozen_string_literal). The two are complementary, not competing.
• vs. bundler-audit — bundler-audit only checks Gemfile.lock against a vulnerability database and names a version to upgrade to. Scryer's dependency audit does the same (live via OSV.dev rather than a bundled database) but is one piece of a much broader scan, and scryer fix --deps can actually run the upgrade and re-verify it.
• The actual differentiator: no single-purpose tool above ranks findings across categories. Scryer's top_risks output answers "what's most worth fixing right now" across security + performance + dependencies + code quality in one severity-ordered list — none of Brakeman, RuboCop, or bundler-audit produce that view, run separately or together.
• Also distinct: a documented, tested fix-verification loop (scryer verify) that re-runs the specific rule against the specific file to confirm a fix cleared it — including automatically verifying every AI-rewritten suggestion before it's ever written to disk.
• Full comparison table (with footnotes) here if useful for the PR:

https://github.com/ramlaxmanyadav/scryer/blob/main/docs/architecture.md#scryer-vs-rubocop-vs-brakeman-vs-bundler-audit