README.md in brakeman-min-0.3.1 vs README.md in brakeman-min-0.3.2
- old
+ new
@@ -1,10 +1,10 @@
# Brakeman
Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
-It targets Rails versions > 2.0 and < 3.0.
+It targets Rails versions > 2.0 with experimental support for Rails 3.x
# Installation
Using RubyGems:
@@ -23,11 +23,11 @@
To specify an output file for the results:
brakeman -o output_file app_path
-The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, and `csv`.
+The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `csv`, and `tabs`.
To suppress informational warnings and just output the report:
brakeman -q app_path
@@ -49,11 +49,11 @@
To indicate certain methods are "safe":
brakeman -s benign_method,totally_safe app_path
-By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would a warning:
+By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would cause a warning (Rails 2):
<%= some_method(:option => params[:input]) %>
To only raise warnings only when untrusted data is being directly used:
@@ -79,10 +79,10 @@
To only get warnings above a given confidence level:
brakeman -w3 app_path
-The `-w` switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only high confidence warnings).
+The `-w` switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only highest confidence warnings).
# Configuration files
Brakeman options can stored and read from YAML files. To simplify the process of writing a configuration file, the `-C` option will output the currently set options.