This project follows the open-source Ruby security tooling approach described in Securing your Ruby and Rails Codebase (OccamsLabs): SCA for dependencies and SAST for insecure code patterns.

rubocop-gitlab-security from that article is archived; its successors live in gitlab-styles. For this gem we stick to RuboCop’s built-in Security department to avoid a heavy style stack.

Security gems live in the :security group:

bundle config set --local with security
bundle install

bundle exec rake security

That runs:

1. bundle audit check --update (via rake bundle:audit)
2. rubocop with .rubocop.yml (security cops only)

Or individually:

bundle exec bundle-audit check --update
bundle exec rubocop

Ruby object macros use Kernel#eval in lib/rivescript/lang/ruby.rb. That is required by the RiveScript object-macro design (same idea as JS eval in rivescript-js). Mitigations:

• Default can be turned off: RiveScript.new(enable_object_macros: false)
• Or at runtime: bot.set_handler("ruby", nil)
• Only load brains you trust (see lang.ruby.md)

The Security/Eval offense on that line is disabled with an inline comment.

The GitHub Actions Security job runs rake security on every push and PR.