Brakeman is great. I think it should check the Gemfile also. Seems like a good place for it. The opinion is mixed though.

https://github.com/presidentbeef/brakeman/issues/276

A complementary command-line tool would be fine too.