Hacker GitHub

← All repos

rubysec/bundler-audit

View on GitHub ↗ ★ 2,764 Ruby

Patch-level verification for Bundler

16 mentions on Hacker News by 15 people: 3 stories, 13 comments · first 2013-02-13 · latest 2019-04-04

Mentions per year 16 mentions · busiest year 2013 (7)
20082026
AllStoriesComments NewestTopOldest
  1. …application. It should be part of your CI pipeline, or at a minimum, run locally every so often. https://github.com/rubysec/bundler-audit
    comment by jlangenauer · 2019-04-04 · in Malicious remote code execution backdoor discovered bootstrap-sass Ruby gem
  2. …Here's a sample Dockerfile[2] for running bundler-audit against your Gemfile and Gemfile.lock 1: https://github.com/rubysec/bundler-audit 2: https://gist.github.com/andrewhampton/d78df6952e757fd1038401...
    comment by AndrewHampton · 2017-10-17 · in Show HN: Octotrack – automatic dependency and security manager for Ruby apps
  3. For gems I use `bundler-audit`, see: https://github.com/rubysec/bundler-audit It checks for vulnerable versions of gems in `Gemfile.lock`, checks for insecure gem sources, allows ignoring certain advisories that have been manually worked…
    comment by itsmrwave · 2017-08-27 · in Ask HN: How do you keep track of node packages/ruby gems security issues?
  4. In ruby land, there's a great gem - https://github.com/rubysec/bundler-audit - that lets you know when specific gem versions have a known security vulnerability. We run it as part of our CI. When a vulnerability drops, it gets fixed pretty…
    comment by ghiculescu · 2017-03-09 · in The Frequency of Known Vulnerabilities in JavaScript
  5. https://github.com/rubysec/bundler-audit
    comment by ianlevesque · 2016-11-21 · in Bringing Down Millions of WordPress Sites
  6. …Checking the git history, I see that phillmv is a contributor to ruby-advisory-db. https://github.com/rubysec/bundler-audit https://github.com/rubysec/ruby-advisory-db
    comment by sciurus · 2015-08-07 · in Show HN: Is it vulnerable? Drag-n-drop your Gemfile.lock to check
  7. …scanner of Gemfile based on bundler-audit[1]? Do you add other value to this part? [1] https://github.com/rubysec/bundler-audit
    comment by altharaz · 2015-07-24 · in Show HN: AppCanary – Keep vulnerable software off your servers
  8. …ecosystem to consider using and contributing to the advisory database. It's the database that powers http://github.com/rubysec/bundler-audit and (disclaimer: I made this) https://gemcanary.com and the more people contributing the more we…
    comment by phillmv · 2014-04-24 · in Ruby Security Have You Not
  9. …The rubysec-advisory-db is meant to power discovery tools such as https://github.com/postmodern/bundler-audit (from which it was originally extracted) or https://gemcanary.com (it bears mentioning that my company made it). I
    comment by phillmv · 2013-03-18 · in Rails Vulnerability Compilation
  10. …on your own, no giving away access to your Github repositories necessary. Check out bundle-audit: https://github.com/postmodern/bundler-audit
    comment by dguido · 2013-02-28 · in Don't find out about Ruby vulnerabilities through Hacker News and Twitter
  11. …dependency security checker... bundler-audit will probably end up being the de facto tool for that: https://github.com/postmodern/bundler-audit
    comment by InAnEmergency · 2013-02-28 · in Don't find out about Ruby vulnerabilities through Hacker News and Twitter
  12. https://github.com/postmodern/bundler-audit
    comment by ushi · 2013-02-16 · in CVE-2013-0871: Linux arbitrary kernel-mode code execution
  13. Also see related projects: - https://github.com/rubysec/ruby-advisory-db - https://github.com/postmodern/bundler-audit
    comment by thibaut_barrere · 2013-02-14 · in Tell HN: Join rubysec-announce for ruby security vulnerabilities notifications