bundler-audit review
A focused, open-source Gemfile.lock auditor for Ruby teams, with offline scans and JSON output.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
bundler-audit is an open-source command-line tool for Ruby and Bundler projects. It checks Gemfile.lock files for vulnerable gem versions and insecure gem sources, using ruby-advisory-db for vulnerability information. Ruby teams can use it in local development or CI to audit dependencies and inspect advisory details, including remediation versions. Its narrow scope suits teams looking specifically for Bundler dependency checks rather than a broader software composition analysis platform.
The tool focuses on lockfile auditing: it can update the advisory database, scan a custom Gemfile.lock path, and ignore selected advisories. Results can be printed as advisory information or exported as JSON. Rake tasks cover auditing and database updates, fitting projects that already use Rake. It can also run without a network connection, which supports offline audit workflows, though database updates require access to the advisory database. The published repository lists version 0.9.3 as its latest release.
bundler-audit is self-hosted, installed as a Ruby gem, and runs on Linux and macOS. It integrates with Rake and ruby-advisory-db; this is a focused Ruby ecosystem fit, not a multi-language dependency management layer. Teams needing SBOM generation, reachability analysis, or pull request scanning should choose a broader tool. For Ruby teams seeking a free, open-source way to check Bundler lockfiles and review remediation versions, its limited scope is also its practical advantage.
bundler-audit pros and cons
- Where it wins
- Finds vulnerable gem versions and insecure HTTP or Git sources.
- Prints advisory details and remediation versions; exports JSON.
- Supports custom lockfiles, Rake tasks, and offline operation.
- Where it doesn't
- Limited to Ruby gems and Bundler projects.
- Does not provide SBOM generation or reachability analysis.
- Does not scan pull requests.
bundler-audit fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update