Hacker News Reader

Brakeman will not check all gem dependencies and is not a general-purpose gem dependency security checker... bundler-audit will probably end up being the de facto tool for that: https://github.com/postmodern/bundler-audit

Yeah, brakeman is awesome, here is a railscast for anyone interested: http://railscasts.com/episodes/358-brakeman

Brakeman is great. I think it should check the Gemfile also. Seems like a good place for it. The opinion is mixed though.

https://github.com/presidentbeef/brakeman/issues/276

A complementary command-line tool would be fine too.