On exactly this subject, I'm in the process of building a SaaS app that will alert you of security vulnerabilities in Gems in your Rails and other Ruby apps.
Sign up at my landing page to here more when I'm closer to launch
The problem with an upload is that you rely on someone to re-upload when they change their Gems. Changing the locked Gems means a re-check is needed, as they might have switched to bad versions.
Making this automatic is the key part - if you don't get burned very often, you'll eventually forget to do the right thing manually and open yourselves to badness.
Comments
On exactly this subject, I'm in the process of building a SaaS app that will alert you of security vulnerabilities in Gems in your Rails and other Ruby apps.
Sign up at my landing page to here more when I'm closer to launch
http://www.rubyaudit.com
You should know that New Relic is already doing this with Rails versions right now
Doesn't seem to be anywhere to sign up.
Doh! I just got the landing page setup, and the signup configured, but never pushed it out.
Try it now.
Thanks
Interesting idea, it looks like you scan the Gemfile.lock (or equivalent) at "deploy" time.
My preference would be to upload that Gemfile.lock to a location, and then it could be scanned as and when new vulnerabilities were detected.
The problem with an upload is that you rely on someone to re-upload when they change their Gems. Changing the locked Gems means a re-check is needed, as they might have switched to bad versions.
Making this automatic is the key part - if you don't get burned very often, you'll eventually forget to do the right thing manually and open yourselves to badness.