One of my workmates open-sourced this: https://github.com/livingsocial/bundler-patch

...which is mostly what we used internally for working with bundler-audit. We ran this scan in CI, on deploy, and also on a cron for apps that might not have deployed in a while. Internally this created PRs automatically, and PRs triggered CI, so eg when a nokogiri CVE was announced (which affects a lot of projects), all apps would have tested PRs ready to merge.

That piece wasn't open-sourced I think...it's fairly trivial but I'll see if I can get it released. We also did scans on clojure projects, again I'm not sure that's made it out into the world, I'll look into it.