How does Kevlar-CheckDeps differ from bundler-audit?

bundler-audit requires installing Ruby gems and updating ruby-advisory-db repositories. Kevlar-CheckDeps is a zero-dependency CLI that parses Gemfile.lock natively using Python stdlib and batch queries Google OSV DB.

Do I need Ruby runtime installed to audit Gemfile.lock?

No. Kevlar-CheckDeps parses static Gemfile.lock text files directly without needing Ruby or Bundler installed.

Can Kevlar-CheckDeps break CI/CD builds for vulnerable Ruby gems?

Yes. Kevlar-CheckDeps supports --fail-on-vulns to break GitHub Actions or GitLab CI pipelines upon detecting critical or high vulnerabilities.

⚡ Ruby Ecosystem SCA CLI

Ruby Dependency Audit CLI: Fast, Zero-Dependency SCA for Bundler

Audit direct and transitive Ruby gems, detect vulnerabilities in the Google OSV database, and validate Gemfile.lock integrity—without Ruby runtime or API keys.

$ python kevlar.py --tech ruby --path ./my-ruby-app --all --vuls

Bundler (`Gemfile.lock`) Gems Spec (`Gemfile`)

bash - kevlar-checkdeps (ruby)

user@devsecops ~/my-ruby-app

$ python kevlar.py --tech ruby --path . --all --vuls

[INFO] Detected Ecosystem: Ruby (Bundler)

[INFO] Reading Gemfile.lock & Gemfile...

[INFO] Checking 48 Ruby gems against Google OSV DB...

[OK] Checked: 48 gems in 0.58s. 0 Vulns Found.

Status: ✅ PASS

The Problem with Traditional SCA Tools in Ruby

Why do tools like bundler-audit require managing local advisory git repos and Ruby runtimes in CI?

Traditional Tools

(bundler-audit)

Limitations

Requires Ruby Runtime & Git Sync

Requires installed Ruby runtime and updating local ruby-advisory-db git repos before every scan.

Kevlar-CheckDeps

(Ruby Audit)

Solution

Zero Ruby Runtime Needed

Executes standalone via Python stdlib, parsing Gemfile.lock text files directly.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive Ruby dependencies querying Google OSV DB:

Scan Command:


                                        $ python kevlar.py --tech ruby --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:


                                            $ python kevlar.py --tech ruby --path ./ --all --vuls --output report.html

Report SARIF:


                                            $ python kevlar.py --tech ruby --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:


                                        $ python kevlar.py --tech ruby --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Frequently Asked Questions (FAQ)

Quick answers to common questions about Ruby dependency auditing.