- Home
- Ruby Static Analysis Tools
- Dawnscanner
Dawnscanner
What it is
Dawnscanner is a static analysis security scanner for Ruby web applications. It supports Ruby on Rails, Sinatra, and Padrino, and reads a project's Gemfile.lock to identify its Ruby version and MVC framework before applying relevant checks. The project README says version 2.0 has more than 680 security checks in its knowledge base, which includes NIST CVE bulletins, custom checks, and OWASP Ruby on Rails cheat-sheet recommendations. Dawn can analyze view code and trace sinks to identify cross-site scripting and SQL injection issues. Its scan results list vulnerabilities and mitigation actions, and are available only in text format. The scanner runs locally from the command line on Linux or in a self-hosted setup. Installation uses `gem install dawnscanner`, and the knowledge base must be downloaded separately. The README names GitHub hooks as an example of using Dawn in a release process. Dawnscanner is MIT licensed and free; its listed plan costs nothing. The project invites feedback and support through issues opened with a reference.
For and against
For
- Supports Rails, Sinatra, and Padrino.
- Knowledge base includes more than 680 checks in version 2.0.
- Can identify cross-site scripting and SQL injection issues.
- Scan results include mitigation actions.
- Free and MIT licensed.
Against
- Results are available only in text format.
- Knowledge base must be downloaded separately.
- No IDE or CI/CD support is listed.
The verdict
Dawnscanner applies Ruby-focused checks to supported web applications and reports vulnerabilities with mitigation actions. It runs locally or self-hosted, and installation and knowledge-base setup are separate steps.
Who it suits
Dawnscanner may suit developers working on Ruby web applications who want local static analysis for supported frameworks. It is listed for Linux and self-hosted deployment.
Plans and prices
Dawnscanner
MIT-licensed Ruby security scanner · runs locally from the command line
Read 8 Oct 2026 · github.com
On the record
- Analysis
- Dawn reads Gemfile.lock, detects the Ruby version and MVC framework, and applies relevant checks.github.com · read 8 Oct 2026
- Checks
- The README says version 2.0 has more than 680 security checks in its knowledge base.github.com · read 8 Oct 2026
- Code analysis
- It can analyze view code and trace sinks to identify cross-site scripting and SQL injection issues.github.com · read 8 Oct 2026
- Distribution
- The repository identifies the project as MIT licensed.github.com · read 8 Oct 2026
- Frameworks
- It supports Ruby on Rails, Sinatra, and Padrino applications.github.com · read 8 Oct 2026
- Installation
- The README instructs users to install the tool with `gem install dawnscanner` and download its knowledge base separately.github.com · read 8 Oct 2026
- Integration
- The README mentions use with GitHub hooks as an example of integrating Dawn into a release process.github.com · read 8 Oct 2026
- Knowledge base
- The knowledge base includes NIST CVE bulletins, custom checks, and OWASP Ruby on Rails cheat-sheet recommendations.github.com · read 8 Oct 2026
- Purpose
- Dawn is a static analysis security scanner for Ruby web applications.github.com · read 8 Oct 2026
- Results
- Scan results list vulnerabilities and mitigation actions, and the README says they are available in text format only.github.com · read 8 Oct 2026
- Security data updates
- The knowledge-base repository lists v20240116 as its latest release.github.com · read 8 Oct 2026
- Support
- The README invites users to provide feedback and support the project by opening an issue with a reference.github.com · read 8 Oct 2026
