bundler-audit

Free#61 of 65 in Software Composition Analysis SoftwareRuby Static Analysis Tools

Patch-level vulnerability checks for Ruby Bundler dependencies.

—Not yet scored

Visit RubySec

bundler-audit— Visit RubySec

At a glance

Editor score
Not yet scored
Pricing
Open source
Best for
Ruby teams auditing Bundler dependencies
Paid from
None
Founded
2013
Facts checked
19 Sep 2026

Where it wins
- Finds vulnerable gem versions and insecure HTTP or Git sources.
- Prints advisory details and remediation versions; exports JSON.
- Supports custom lockfiles, Rake tasks, and offline operation.
Where it doesn't
- Limited to Ruby gems and Bundler projects.
- Does not provide SBOM generation or reachability analysis.
- Does not scan pull requests.

Our verdict on bundler-audit

bundler-audit is an open-source command-line tool for Ruby and Bundler projects. It checks Gemfile.lock files for vulnerable gem versions and insecure gem sources, using ruby-advisory-db for vulnerability information. Ruby teams can use it in local development or CI to audit dependencies and inspect advisory details, including remediation versions. Its narrow scope suits teams looking specifically for Bundler dependency checks rather than a broader software composition analysis platform.

The tool focuses on lockfile auditing: it can update the advisory database, scan a custom Gemfile.lock path, and ignore selected advisories. Results can be printed as advisory information or exported as JSON. Rake tasks cover auditing and database updates, fitting projects that already use Rake. It can also run without a network connection, which supports offline audit workflows, though database updates require access to the advisory database. The published repository lists version 0.9.3 as its latest release.

bundler-audit is self-hosted, installed as a Ruby gem, and runs on Linux and macOS. It integrates with Rake and ruby-advisory-db; this is a focused Ruby ecosystem fit, not a multi-language dependency management layer. Teams needing SBOM generation, reachability analysis, or pull request scanning should choose a broader tool. For Ruby teams seeking a free, open-source way to check Bundler lockfiles and review remediation versions, its limited scope is also its practical advantage.

bundler-audit pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.

See plans on github.com

bundler-audit fact sheet

Free plan	Not verified
Paid from	None
Supported ecosystems	Ruby gems and Bundler
SBOM generation	Not verified
Reachability analysis	Not verified
Pull request scanning	Not verified
Monitored projects	Not verified
Deployment options	Self_hosted
Deployment	Desktop
Platforms	Linux, macOS
Integrations	2 integrations: Rake, ruby-advisory-db
Pricing	Open source
Website	github.com
Facts checked	19 Sep 2026

bundler-audit integrations

bundler-audit lists 2 integrations on its own site.

Rake
ruby-advisory-db

Alternatives to bundler-audit

See all bundler-audit alternatives →

Also listed in

Ruby Static Analysis Tools

Used bundler-audit? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used bundler-audit for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used bundler-audit myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

bundler-audit is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/bundler-audit/"><img src="https://www.itechguides.com/best/badge/bundler-audit.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Guides on software composition analysis software

Top 5 Software Composition Analysis Tools for 2025: Snyk, Black Duck, Sonatype, Mend, and FOSSAAug 2026

Reviewed by iTechGuides Editors · Editorial team · Updated Sep 2026

Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. It never changes a score or a verdict. How we rank.