DEV Community

Wilbur Suero
Wilbur Suero

Posted on

🚨 Introducing GemGuard: Automated Security for Ruby Gems (Scan, SBOM, Typosquat, Auto-Fix)

#ruby #security #devops #opensource

Links:

TL;DR

  • âś… Scan dependencies for known vulnerabilities (OSV.dev + Ruby Advisory DB)
  • 🕵️ Detect typosquat packages before they bite
  • đź“ś Generate SPDX / CycloneDX SBOMs
  • đź›  Auto-fix vulnerable gems safely
  • ⚡ Clean CLI + CI-ready
  • Version: 1.1.x

Why GemGuard?

Because security shouldn’t be an afterthought. It should be:

  • Pragmatic – only what matters, no noise
  • Fast – instant feedback in dev or CI
  • Integrated – works with your normal Ruby workflow

What is GemGuard?

GemGuard is a lightweight Ruby security tool that:

  • Scans your Gemfile.lock for known vulnerabilities
  • Detects typosquat risks via fuzzy matching
  • Generates SBOMs (SPDX and CycloneDX)
  • Auto-fixes vulnerable gems with safe version upgrades
  • Plays nicely with CI/CD

Installation 

# Add to your Gemfile (recommended for projects) gem "gem_guard", "~> 1.1" # Or install globally gem install gem_guard
Enter fullscreen mode Exit fullscreen mode

Verify: 

gem_guard version # => 1.1.x
Enter fullscreen mode Exit fullscreen mode

Quick Start

Scan your project:

gem_guard scan # ✅ No vulnerabilities found! # or exits non‑zero if issues are found
Enter fullscreen mode Exit fullscreen mode

Detect typosquats: 

gem_guard typosquat # No potential typosquat dependencies found.
Enter fullscreen mode Exit fullscreen mode

Generate an SBOM: 

gem_guard sbom --format spdx --output sbom.spdx.json gem_guard sbom --format cyclonedx --output bom.cdx.json
Enter fullscreen mode Exit fullscreen mode

Auto‑Fix Vulnerabilities

Preview (dry run):

gem_guard fix --dry-run
Enter fullscreen mode Exit fullscreen mode

Apply fixes (creates a Gemfile.lock backup by default): 

gem_guard fix # 📦 Created backup: Gemfile.lock.backup.2025... # ✅ Updated nokogiri to 1.18.9 # 🔄 Running bundle install to update lockfile...
Enter fullscreen mode Exit fullscreen mode

Options:

  • --interactive: confirm each update
  • --no-backup: skip lockfile backup
  • --gemfile, --lockfile: custom paths

Tip: Re-scan after fixing

gem_guard scan
Enter fullscreen mode Exit fullscreen mode

Clean CLI 

gem_guard --help # config, scan, typosquat, sbom, fix, version
Enter fullscreen mode Exit fullscreen mode

Exit codes:

  • 0: success / no vulns
  • 1: vulnerabilities found
  • 2: errors (e.g., missing files)

CI/CD Integration (GitHub Actions) 

name: security-scan on: [push, pull_request] jobs: gemguard: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: ruby/setup-ruby@v1 with: ruby-version: '3.3' bundler-cache: true - run: gem install gem_guard - run: gem_guard scan --format json > gemguard-report.json - run: gem_guard typosquat --format json > typosquat-report.json - name: Upload reports uses: actions/upload-artifact@v4 with: name: gemguard-reports path: | gemguard-report.json typosquat-report.json
Enter fullscreen mode Exit fullscreen mode

Fail builds on vulnerabilities (default behavior). If you want non-blocking scans (e.g., on main), wrap with || true or use matrix strategies.

Configuration

Create .gemguard.yml:

lockfile: Gemfile.lock output: format: table # table | json typosquat: similarity_threshold: 0.82 risk_levels: high: 0.9 medium: 0.85
Enter fullscreen mode Exit fullscreen mode

View current config:

gem_guard config --show
Enter fullscreen mode Exit fullscreen mode

Why GemGuard?

  • Minimal setup, zero noise
  • Pragmatic defaults, sensible exit codes
  • Works offline for typosquat via fallback popular gems
  • Well-tested (RSpec), standardrb formatting
  • Designed for CI from day 1

How It Compares

  • Bundler Audit: great for advisories; GemGuard adds typosquat + SBOM + auto-fix
  • OSV-Scanner: broad ecosystem; GemGuard is Ruby-first with tighter UX and auto-fix
  • Trivy/Grype: container focus; GemGuard slots into pure-Ruby pipelines easily

Use GemGuard standalone or alongside your existing stack.

Roadmap

  • Enriched advisories (GHSA/CVE links, CVSS)
  • Optional dependency graph visualizations
  • Interactive TUI
  • More fix strategies and guards

Contribute / Feedback

  • Issues/PRs welcome: add tests, keep it minimal and intention-revealing
  • Prefer failing test → minimal fix → refactor
  • Security disclosures: see SECURITY.md

Try It Now 

gem install gem_guard gem_guard scan gem_guard typosquat gem_guard fix --dry-run
Enter fullscreen mode Exit fullscreen mode

If this helps you ship safer Ruby apps with less fuss, drop a ❤️ and share!

— Built for Rubyists who like fast feedback, clean CLIs, and reliable automation.

Issues and PRs welcome → github.com/wilburhimself/gem_guard

Top comments (0)