Find a replacement for Brakeman scanner in SAST

Problem to solve

We need to replace Brakeman for SAST

Further details

Brakeman's got acquired by Synopsys, and under the new license: " it is no longer possible to use Brakeman OSS for the development of a commercial product or online service or to resell Brakeman OSS as a service." [1]

Proposal

Benchmark other tools, and replace brakeman if possible. If we don't find a good fit, we should start deprecating Ruby On Rails support in SAST.

We should evaluate:

• Dawnscanner
• OSS brakeman fork called railroader
  • These are not good replacements, as described in the comment below

What does success look like, and how can we measure that?

Either a new tool wrapper replacing Brakeman, or deprecation notice + complete removal later.

Links / references

• [1] https://brakemanscanner.org/blog/2018/06/28/brakeman-has-been-acquired-by-synopsys/

/cc @bikebilly