scryer 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e14bfb1c3912e5ce4773838e90a19b9f5acd3814cf8f216052ca91784473863b
-  data.tar.gz: 9f70388a0d3537da003c1c621117df0c3bf953e0a3aaea63e8b56ea4dc3c8d1f
+  metadata.gz: e1c8d4523447f9bdd1ea796fd27177efa18d6f726be6764e08aac1b18e05482b
+  data.tar.gz: de971058c3bfd42ad8ed9eabb6b633b305d1d10dc4971ea50e606fdefd573067
 SHA512:
-  metadata.gz: 387810bd90bd1031be8c6b0b8debf3ee0ef91dfa982dfdf03afb331be07d7d41379b6e4e33fc340465c7da1e7f9d28a5eb186b2ec630826d54fb9522953085ec
-  data.tar.gz: d2adf3bb70c181e2c874354c963828fb06e6dcd69dec7417b69fe064653da1df1b9a7cc82a14e4b7dd5fe4623876978dfb4a28469ae63d87df6c54d544334455
+  metadata.gz: 516425ec399996c7d20d20d6e8e222f188bf227cf911c401cdf514c084de22adcb9d7d15d2629cbb4cf79d0f3ef1f939058e64d24d14f0b3a3239d3922289270
+  data.tar.gz: 8c5efc1769526f6d8ed9b335a53129ac8f461156719e846d00f30e1ceae340f9b774bd83c89814689351b87c1200fb28fb5c76f4420bb4d86a296042717254d8

data/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+All notable changes to this project are documented here. Format loosely follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [0.2.0] - 2026-08-11
+
+- New `style` rule category (`Scryer::RuleSet` category `"style"`, alongside `security` and
+  `performance`): a deliberately narrow first check, `frozen_string_literal`, flags Ruby files
+  missing the `# frozen_string_literal: true` magic comment (info severity). Findings appear
+  everywhere other findings do (JSON/HTML/CSV reports, AI-assisted fix suggestions, `--skip`), and
+  are counted under "Code Quality" in the summary box alongside duplicate-code groups. This
+  remains the *only* style/lint check Scryer performs — see the README's Scryer-vs-RuboCop
+  comparison for why the rest of that territory is intentionally left to RuboCop.
+- Fixed: `bin/rails scryer:report` now fails (non-zero exit) when security or dependency findings
+  are present, matching `scryer` (the standalone executable) and `scryer:audit_dependencies`. Previously
+  it always exited 0 regardless of findings, so it couldn't actually gate a CI job the way the
+  README described.
+- Added `LICENSE.txt` (MIT) — declared via `spec.license` since 0.1.0 but not previously shipped
+  as an actual file.
+- `spec.homepage` now points to the live docs site (https://ramlaxmanyadav.github.io/scryer/)
+  instead of the GitHub repo — the repo is still one click away via `source_code_uri` in
+  `spec.metadata`.
+
+## [0.1.0] - 2026-08-10
+
+Initial release.
+
+- Static security scan (`Ripper`-based, no Rails/Bundler needed to run it): SQL injection, mass
+  assignment, command injection, hardcoded secrets, unsafe deserialization, XSS-prone unescaped
+  HTML, CSRF gaps, weak cryptography, open redirects.
+- Performance heuristics: N+1 queries, missing pagination, inefficient per-record saves, unbounded
+  full-table iteration.
+- Duplicate/near-duplicate code detection via token-normalized similarity.
+- Dependency audit against `Gemfile.lock` — known-vulnerable gem versions (live OSV.dev query) and
+  insecure git/http sources — runs by default on every scan (`--no-deps`/`nodeps` to opt out).
+- Rule skipping: `c.skip_rules` / `--skip RULE_ID` to silence a specific check without editing it.
+- One-off single-gem vulnerability lookup: `scryer --check-gem NAME[:VERSION]`.
+- JSON, self-contained HTML, and CSV report formats.
+- Optional, provider-agnostic AI-assisted fix suggestions (`Scryer::AiFixSuggester` +
+  `Scryer::AiClient`) — bring any LLM via a `#call(prompt)`/`#complete(prompt)` interface.
+- Opt-in runtime query watcher (`Scryer::QueryWatcher`) for N+1s and unused eager loading during
+  actual request handling.
+- `scryer` standalone executable and `scryer:report`/`scryer:audit_dependencies` Rails rake tasks.
+
+[0.2.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.2.0
+[0.1.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.1.0

data/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ram Laxman Yadav
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -1,38 +1,168 @@
-# Scryer
+# Scryer — Ruby & Rails Code Security Auditor
 
-A static code analyzer for Rails apps, built on Ruby's own `Ripper` (stdlib — no Rails or
-`bundle install` needed to run the scan itself). Reports three things:
+Scryer is a Ruby static code analysis and security auditing tool. It analyzes Ruby and Rails
+projects, audits `Gemfile.lock` dependencies for known vulnerabilities, identifies potential
+security, performance, and code-quality issues, and gives you an actionable, human-reviewable
+suggestion for fixing each one.
 
-- **Security findings**: SQL injection via string interpolation, unpermitted mass assignment,
-  command injection, hardcoded API keys/secrets, unsafe deserialization (`Marshal.load`/
-  `YAML.load`/`JSON.load`), unescaped-HTML XSS risk (`.html_safe`/`raw`), CSRF protection gaps,
-  weak password hashing, and open redirects.
-- **Duplicate code**: near-duplicate methods across the codebase, via token-normalized similarity
-  (renamed variables/changed literals still count as "the same shape").
-- **Performance heuristics**: likely N+1 queries, missing pagination on index actions,
-  inefficient per-record save loops, and unbounded full-table iteration.
+Most Rails teams already run several separate tools to cover code quality and security: RuboCop
+for style, Brakeman for security, bundler-audit for dependency CVEs, Reek for code smells, plus
+whatever custom scripts glue their outputs together in CI — different gems, different config
+files, different report formats, different CI steps to maintain.
+
+**Scryer's job is to be the one audit command that covers all of it** — security vulnerabilities,
+performance problems, duplicate/smelly code, and dependency vulnerabilities — in a single scan
+with a single report:
+
+```bash
+gem install scryer
+scryer
+```
+
+```
+Scryer Audit — 236 files scanned
+────────────────────────────────
+
+Security                8 findings
+Performance            10 findings
+Code Quality          248 findings
+Dependencies           24 findings
+────────────────────────────────
+Total                 290 findings
+
+JSON report: tmp/scryer_report.json
+HTML report: tmp/scryer_report.html
+```
+
+That's real output from a scan of a live 236-file Rails app — not a mockup. See
+[Scryer vs RuboCop vs Brakeman vs bundler-audit](#scryer-vs-rubocop-vs-brakeman-vs-bundler-audit)
+below for exactly how it stacks up against the tools it's meant to consolidate.
+
+### What Scryer detects
+
+**Security**
+
+* SQL injection
+* Mass assignment
+* Command injection
+* Hardcoded secrets
+* Unsafe deserialization
+* XSS-prone HTML
+* CSRF gaps
+* Weak cryptography
+* Open redirects
+
+**Code quality**
+
+* Near-duplicate code
+* Repeated logic
+* Potentially problematic code patterns
+* Missing `frozen_string_literal` magic comment (the one deliberate, narrow style check — see
+  [comparison table](#scryer-vs-rubocop-vs-brakeman-vs-bundler-audit) for why not more)
+
+**Performance**
+
+* N+1 queries
+* Missing pagination
+* Inefficient per-record saves
+* Unbounded full-table iteration
+
+**Dependencies**
+
+* Known dependency vulnerabilities via OSV.dev
+* Insecure gem sources
+
+### Example findings
+
+Real output — three lines of deliberately flawed Rails code, scanned with plain `scryer`:
+
+```ruby
+def create
+  @invoice = Invoice.create(params[:invoice])
+end
+```
+
+```
+[CRITICAL] mass_assignment — app/controllers/invoices_controller.rb:3
+`create` receives `params` (or a subscript of it) directly, with no `.permit(...)` call — every
+attribute in the request can be set, including ones the form/API was never meant to expose (e.g.
+`admin`, `role_id`).
+
+fix: Wrap the params in a strong-parameters method, e.g. `create(order_params)` with
+`def order_params; params.require(:order).permit(:status, :total); end` — only the explicitly
+permitted keys get through.
+```
+
+```ruby
+Invoice.where("customer_name = '#{name}'")
+```
+
+```
+[CRITICAL] sql_injection — app/controllers/invoices_controller.rb:9
+`where` is called with a string built via interpolation, which lets user-controlled input change
+the SQL executed.
+
+fix: Use a parameterized form instead, e.g. `where("column = ?", value)` or the hash form
+`where(column: value)` — both let Active Record escape the value safely instead of interpolating
+it directly into SQL.
+```
+
+```ruby
+@invoices = Invoice.where(status: "open")
+@invoices.each { |invoice| invoice.account.name }
+```
+
+```
+[WARNING] n_plus_one_query — app/controllers/invoices_controller.rb:14
+`invoice.account` is called inside a loop — if `account` is an association, this issues a separate
+query per iteration instead of one batched query (a classic N+1).
+
+fix: Eager-load the association on the base query before the loop, e.g.
+`invoices = Model.includes(:account).where(...)` (or add `:account` to an existing `.includes(...)`
+call), so Rails fetches it in one extra query instead of one per record.
+```
+
+Every finding follows this shape, whichever category it's in: exactly where the issue is, why it
+matters, and a fix written against your actual code — not a generic paragraph you have to
+translate into your own file.
+
+### Reports
+
+Generate detailed JSON or self-contained HTML reports:
+
+```bash
+scryer -o report.json -o report.html
+```
+
+### Developer-friendly suggestions
+
+Every finding includes a human-reviewable suggested fix. Scryer never automatically modifies your source code.
+
+### Runtime analysis
+
+Scryer can optionally monitor ActiveRecord queries at runtime to detect N+1 queries and unused eager loading.
+
+### Designed for Ruby
+
+Scryer uses Ruby's standard-library `Ripper` parser, allowing source analysis without requiring Rails or Bundler to run the static scan itself.
 
 Several more things live alongside the static scan, each documented in its own section below:
 
 - **Skipping rules** ([Skipping rules](#skipping-rules)): silence a specific rule by `rule_id`
   (config-wide via `c.skip_rules`, or one-off via `--skip`) without editing or deleting it.
-- A **runtime query watcher** ([Runtime query watcher](#runtime-query-watcher)) that instruments a
-  *running* app to catch N+1 queries and unused eager loading as they actually happen — the same
-  broad goal as [Bullet](https://github.com/flyerhzm/bullet), built independently on a different
-  mechanism.
-- A **dependency audit** ([Dependency audit](#dependency-audit)) that checks `Gemfile.lock` against
-  [OSV.dev](https://osv.dev) for known-vulnerable gem versions and insecure sources — the same
-  broad goal as [bundler-audit](https://github.com/rubysec/bundler-audit), built independently on a
-  different data source.
+- A **dependency audit** ([Dependency audit](#dependency-audit)), on by default, that checks
+  `Gemfile.lock` against [OSV.dev](https://osv.dev) for known-vulnerable gem versions and insecure
+  sources — the same broad goal as [bundler-audit](https://github.com/rubysec/bundler-audit), built
+  independently on a different data source. Pass `--no-deps` (or the `nodeps` rake arg) for a fast,
+  fully offline run instead.
 - **AI-assisted fix suggestions** ([AI-assisted fix suggestions](#ai-assisted-fix-suggestions)),
   optional, provider-agnostic: rewrites each finding's `suggested_fix` against its actual code
   using an LLM you configure — any LLM, not a specific vendor.
 
-Every finding includes a `suggested_fix` — human-reviewable text explaining the issue with an
-example. **Nothing is auto-applied.** A security or performance fix needs a human's judgment
-about the surrounding code; this gem's job is to point at the issue and explain it clearly, not
-to rewrite your files. This holds whether `suggested_fix` came from a rule's static template or
-from the optional AI enrichment below — either way, it's text for a human to read and act on.
+**Nothing is auto-applied.** A security or performance fix needs a human's judgment about the
+surrounding code; this gem's job is to point at the issue and explain it clearly, not to rewrite
+your files. This holds whether `suggested_fix` came from a rule's static template or from the
+optional AI enrichment below — either way, it's text for a human to read and act on.
 
 ## A note on how this gem was actually verified
 
@@ -50,6 +180,50 @@ normal for this class of tool, not a bug. An already-guarded call can still get
 rules don't trace surrounding conditionals — always review a finding in its surrounding context
 before acting on it.
 
+## Scryer vs RuboCop vs Brakeman vs bundler-audit
+
+Scryer isn't trying to out-lint RuboCop or out-analyze Brakeman — where an existing tool
+specializes, it's still worth running on its own; style/lint conventions are almost entirely
+RuboCop's job, and Scryer stays out of that territory except for one narrow, deliberately-scoped
+check (see footnote below). What Scryer actually replaces is *stitching several of these together
+yourself*: it covers categories none of the others do alone (performance heuristics,
+duplicate-code detection, runtime query analysis), and folds the categories they *do* cover into
+one command and one report instead of several separate tools, configs, and CI steps.
+
+| Capability                               | Scryer | RuboCop  | Brakeman | bundler-audit |
+|-------------------------------------------|:------:|:--------:|:--------:|:-------------:|
+| Style/lint conventions                     | Partial [h] | ✅  | ❌       | ❌            |
+| Rails security scanning                    | ✅     | ❌       | ✅       | ❌            |
+| Performance heuristics                     | ✅     | Partial [a] | ❌    | ❌            |
+| Duplicate/similar code detection           | ✅     | Partial [b] | ❌    | ❌            |
+| Dependency vulnerability scanning          | ✅     | ❌       | ❌       | ✅            |
+| Runtime query analysis (N+1 in production) | ✅     | ❌       | ❌       | ❌            |
+| HTML report                                | ✅     | Partial [c] | ✅    | ❌            |
+| JSON report                                | ✅     | ✅       | ✅       | Limited [d]   |
+| Human-reviewable fix suggestions           | ✅     | Partial [e] | Partial [f] | Limited [g] |
+| Single command covering all of the above   | ✅     | ❌       | ❌       | ❌            |
+
+- **[a]** `rubocop-performance` adds some Ruby/Rails performance cops, but nothing like N+1-query
+  or missing-pagination detection.
+- **[b]** A handful of cops catch exact-duplicate patterns (e.g. `Lint/DuplicateMethods`) — no
+  near-duplicate/similarity detection across methods.
+- **[c]** RuboCop's built-in HTML formatter is a plain findings list, not an interactive report.
+- **[d]** bundler-audit's output is primarily console text; no first-class JSON formatter.
+- **[e]** RuboCop's `-A` auto-corrects many style violations directly — an automatic rewrite, not
+  a human-reviewable explanation, and only for auto-correctable cops.
+- **[f]** Brakeman's warnings describe the issue and a confidence level, not a concrete
+  before/after code fix.
+- **[g]** bundler-audit names the patched version to upgrade to; no code-level remediation (it
+  doesn't operate on your code at all, only `Gemfile.lock`).
+- **[h]** One check only: a missing `# frozen_string_literal: true` magic comment
+  (`frozen_string_literal`, info severity). Everything else in RuboCop's style/lint domain —
+  naming, layout, quote style, line length, and hundreds more — is intentionally out of scope; see
+  [Skipping rules](#skipping-rules) if you don't want even this one.
+
+If you already run RuboCop for style, keep it — Scryer isn't a replacement for it. If you're
+currently running Brakeman + bundler-audit + a duplicate-code linter as three separate steps,
+Scryer is the "run one thing instead" option.
+
 ## Install
 
 Scryer is a development-time analysis tool, not something a running production process needs —
@@ -80,13 +254,16 @@ scanned, the branch label).
 bin/rails scryer:report   # writes tmp/scryer_report.{json,html}
 ```
 
-By default this writes both `tmp/scryer_report.json` and `tmp/scryer_report.html`. Both format
-and output path are configurable via task args — any mix of `json`, `html`, `csv` plus at most one
-path (quote the whole thing so your shell doesn't eat the brackets/commas, e.g.
+By default this writes both `tmp/scryer_report.json` and `tmp/scryer_report.html`, and includes a
+dependency audit against `Gemfile.lock` (needs network — see [Dependency audit](#dependency-audit);
+pass the `nodeps` arg for a fast, fully offline run instead). Format and output path are
+configurable via task args — any mix of `json`, `html`, `csv` plus at most one path (quote the
+whole thing so your shell doesn't eat the brackets/commas, e.g.
 `bin/rails 'scryer:report[json,doc/security_report.json]'`). Rake splits bracket args on every
 comma, so each format is its own item in the list rather than one comma-joined string
-(`scryer:report[json,html]` is two args, not `"json,html"` as one). At most one non-format token
-is accepted per call; giving two raises an error rather than guessing which one you meant.
+(`scryer:report[json,html]` is two args, not `"json,html"` as one). At most one non-format,
+non-`nodeps` token is accepted per call; giving two raises an error rather than guessing which one
+you meant.
 
 Outside a Rails app (or in CI, or anywhere you don't want a rake task), the gem also ships a
 `scryer` executable — same idea as `brakeman -o report.json`, with `-o` repeatable and format
@@ -97,13 +274,17 @@ scryer                                    # scans ., writes tmp/scryer_report.{j
 scryer -o report.json                     # just one file, exact path, format from extension
 scryer -o report.json -o report.html      # as many outputs as you like, one -o each
 scryer -p /path/to/app -o /tmp/out.html   # -p sets the root to scan (default: cwd)
+scryer --no-deps                          # skip the dependency audit for a fast offline run
 scryer --help                             # full option list (--project-name, --branch, --version, ...)
 ```
 
-It exits `0` when the scan is clean and `1` when there's at least one security finding, so
-`scryer -o report.json` can gate a CI job the same way `brakeman -o report.json` does. A `2` exit
-means a usage error (bad flag, unrecognized output extension) rather than anything about the scan
-itself.
+Console output is a summary box across every category — see the box in the intro above for a real
+example — followed by where each report was written.
+
+It exits `0` when the scan is clean and `1` when there's at least one security or dependency
+finding, so `scryer -o report.json` can gate a CI job the same way `brakeman -o report.json` does.
+A `2` exit means a usage error (bad flag, unrecognized output extension) rather than anything
+about the scan itself.
 
 Or use the scanning engine directly as a library:
 
@@ -119,7 +300,7 @@ of checks that ran, a breakdown of warnings by type, every finding in detail, an
 groups — laid out similarly to a Brakeman report. `tmp/scryer_report.json` has the same data in
 machine-readable form, for feeding into your own dashboard or CI gate. A third format, `.csv`
 (`scryer -o report.csv` / `rails 'scryer:report[csv]'`), is a flat one-row-per-finding table
-(security + performance findings, plus dependency findings if `--include-deps`/`deps` was used) —
+(security + performance findings, plus dependency findings unless `--no-deps`/`nodeps` was used) —
 handy for dropping into a spreadsheet or importing into a ticketing tool. It skips duplicate-code
 groups, which don't reduce to a single actionable row.
 
@@ -222,12 +403,14 @@ library, so it works the same whether or not this happens to run under Bundler.
 source was read or copied to build this.
 
 ```bash
-bin/rails scryer:audit_dependencies   # inside a Rails app
+bin/rails scryer:audit_dependencies   # inside a Rails app — dependency audit only, no static scan
 ```
 
-This is the one part of Scryer that needs a live network connection (to reach OSV.dev) — so
-unlike the static scan, it's not part of the default `scryer`/`scryer:report` run; call it
-explicitly, the same way `bundle-audit check` is a separate command from your test suite. It exits
+This is the one part of Scryer that needs a live network connection (to reach OSV.dev), and it
+runs automatically as part of every `scryer`/`scryer:report` scan — pass `--no-deps` (CLI) or the
+`nodeps` arg (rake) for a fast, fully offline run instead. `scryer:audit_dependencies` above (and
+`scryer --audit-deps` below) are for when you want *only* the dependency audit, the same way
+`bundle-audit check` is a separate, standalone command from your test suite. Either way it exits
 non-zero if anything is found, so it can gate CI.
 
 Two checks run, and either can be called on its own as a library:
@@ -248,9 +431,11 @@ Scryer::DependencyAudit.vulnerable_gems(Rails.root.to_s)   # needs network (OSV.
   and the fixed version(s) to upgrade to.
 
 **From the `scryer` executable** (outside a Rails app, or in CI): `scryer --audit-deps` runs the
-same two checks standalone, same output/exit-code behavior as the rake task. `scryer --include-deps`
-folds them into the normal `-o` report instead — one HTML/JSON/CSV file covering static findings
-*and* dependency findings together. And for a single gem, without touching `Gemfile.lock` at all:
+same two checks standalone (no static scan), same output/exit-code behavior as the rake task above.
+Plain `scryer` already folds them into the normal `-o` report — one HTML/JSON/CSV file covering
+static findings *and* dependency findings together — so `--audit-deps` is only for when you want
+dependency findings *without* the static scan. And for a single gem, without touching
+`Gemfile.lock` at all:
 
 ```bash
 scryer --check-gem rack            # every advisory ever filed against rack, any version
@@ -360,8 +545,12 @@ in a host app for the full description (also in
 
 ## Extending it
 
-Every rule is a small class extending `Scryer::Rule` — see `lib/scryer/rules/*.rb`
-(security) and `lib/scryer/performance_rules/*.rb` (performance) for the pattern. A new
-rule file dropped into either directory is picked up automatically (rules self-register via
-`Rule.inherited` — no manual wiring needed). `Scryer::Ast` has the tree-walking
-helpers used throughout.
+Every rule is a small class extending `Scryer::Rule` — see `lib/scryer/rules/*.rb` (security),
+`lib/scryer/performance_rules/*.rb` (performance), and `lib/scryer/style_rules/*.rb` (style) for
+the pattern. A new rule file dropped into any of the three directories is picked up automatically
+(rules self-register via `Rule.inherited` — no manual wiring needed, just `self.category =
+"security"|"performance"|"style"`). `Scryer::Ast` has the tree-walking helpers used throughout.
+
+## License
+
+MIT licensed.

data/lib/scryer/ai_fix_suggester.rb

@@ -35,13 +35,15 @@ module Scryer
         finding
       end
 
-      # Enhances every security/performance finding on a Scanner::Result in
-      # place. Runs across a small thread pool (network-bound work, same
-      # pattern as DependencyAudit.vulnerable_gems) so a large finding count
-      # doesn't mean one-request-at-a-time. No-op if no client is
-      # configured — callers don't need to check first.
+      # Enhances every security/performance/style finding on a
+      # Scanner::Result in place. Runs across a small thread pool
+      # (network-bound work, same pattern as
+      # DependencyAudit.vulnerable_gems) so a large finding count doesn't
+      # mean one-request-at-a-time. No-op if no client is configured —
+      # callers don't need to check first.
       def enhance_result!(result, client: Scryer.configuration.ai_client, concurrency: 4)
-        enhance_many!(result.security_findings + result.performance_findings, client: client, concurrency: concurrency)
+        enhance_many!(result.security_findings + result.performance_findings + result.style_findings,
+                      client: client, concurrency: concurrency)
         result
       end
 

data/lib/scryer/cli.rb

@@ -33,10 +33,16 @@ module Scryer
 
       result = Scanner.new(root: root, dirs: Scryer.configuration.dirs, skip_rules: skip_rules).call
 
+      # Dependency auditing (OSV.dev) runs by default — a single `scryer`
+      # invocation is meant to cover the same ground as RuboCop + Brakeman +
+      # bundler-audit + Reek run separately, and that story isn't true if
+      # the dependency half is silently skipped unless you remember a flag.
+      # `--no-deps` opts back out for a fast, fully offline run (e.g. no
+      # network in this environment, or you only want the static scan).
+      ran_deps = !options[:no_deps]
       dependency_findings = []
-      if options[:include_deps]
-        @stdout.puts "Scryer: checking Gemfile.lock sources (offline)..."
-        @stdout.puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
+      if ran_deps
+        @stdout.puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
         dependency_findings = DependencyAudit.insecure_sources(root) + DependencyAudit.vulnerable_gems(root)
       end
 
@@ -58,12 +64,7 @@ module Scryer
       outputs = options[:outputs].empty? ? default_outputs(root) : options[:outputs]
       outputs.each { |path| write_report(renderer, path) }
 
-      @stdout.puts "Scryer: #{result.files_scanned} files scanned, " \
-                   "#{result.security_findings.size} security findings, " \
-                   "#{result.performance_findings.size} performance findings, " \
-                   "#{result.duplicate_groups.size} duplicate groups" \
-                   "#{options[:include_deps] ? ", #{dependency_findings.size} dependency findings" : ""}."
-      @stdout.puts "Report written to #{outputs.join(', ')}"
+      print_summary(result: result, dependency_findings: dependency_findings, ran_deps: ran_deps, outputs: outputs)
 
       result.security_findings.empty? && dependency_findings.empty? ? 0 : 1
     rescue UsageError => e
@@ -95,6 +96,42 @@ module Scryer
       total.positive? ? 1 : 0
     end
 
+    # The "one audit command" summary — a single scan's worth of every
+    # category Scryer covers (security, performance, duplicate/smelly code,
+    # dependencies), the same categories usually split across RuboCop +
+    # Brakeman + bundler-audit + Reek, side by side in one box.
+    def print_summary(result:, dependency_findings:, ran_deps:, outputs:)
+      # "Code Quality" is the umbrella label for both duplicate-code groups
+      # and rule-based style findings (e.g. frozen_string_literal) — two
+      # different detectors, same broad concern, one row in the box.
+      code_quality = result.duplicate_groups.size + result.style_findings.size
+      deps_count = ran_deps ? dependency_findings.size : nil
+      total = result.security_findings.size + result.performance_findings.size + code_quality + (deps_count || 0)
+
+      rows = [
+        ["Security", result.security_findings.size],
+        ["Performance", result.performance_findings.size],
+        ["Code Quality", code_quality],
+        ["Dependencies", deps_count]
+      ]
+
+      divider = "─" * 32
+      @stdout.puts ""
+      @stdout.puts "Scryer Audit — #{result.files_scanned} files scanned"
+      @stdout.puts divider
+      @stdout.puts ""
+      rows.each { |label, count| @stdout.puts summary_row(label, count) }
+      @stdout.puts divider
+      @stdout.puts summary_row("Total", total)
+      @stdout.puts ""
+      outputs.each { |path| @stdout.puts "#{format_for(path).upcase} report: #{path}" }
+    end
+
+    def summary_row(label, count)
+      value = count.nil? ? "skipped (--no-deps)" : "#{count} finding#{"s" unless count == 1}"
+      "#{label.ljust(14)}#{value.rjust(20)}"
+    end
+
     # One-off OSV.dev lookup for a single gem — no Gemfile.lock, no scan,
     # no other network calls. `spec` is "name" or "name:version" (colon
     # rather than a second CLI arg, so this stays a single -o-style flag).
@@ -128,13 +165,11 @@ module Scryer
                 "insecure git/http sources (offline), instead of running the normal static scan. " \
                 "Exits non-zero if anything is found, so this can gate CI the same way " \
                 "`bundle-audit check` does.") { options[:audit_deps] = true }
-        opts.on("--include-deps",
-                "Fold a dependency audit (same checks as --audit-deps: OSV.dev vulnerable gems + " \
-                "insecure git/http sources) into the normal report as one more section, instead " \
-                "of running it as a separate command. Combine with -o to get one HTML/JSON " \
-                "report covering static findings, duplicate code, and dependency findings " \
-                "together — and, with an AI client configured, AI-rewritten suggested fixes for " \
-                "all of them.") { options[:include_deps] = true }
+        opts.on("--no-deps",
+                "Skip the dependency audit (OSV.dev vulnerable gems + insecure git/http sources) " \
+                "that otherwise runs as part of every normal scan. Use this for a fast, fully " \
+                "offline run — e.g. no network available, or you only want the static " \
+                "findings.") { options[:no_deps] = true }
         opts.on("--skip RULE_ID",
                 "Skip a rule by rule_id (repeatable) — e.g. a known false positive on this " \
                 "codebase. Adds to c.skip_rules for this run only; doesn't affect other " \

data/lib/scryer/report_renderer.rb

@@ -44,6 +44,7 @@ module Scryer
         "parse_errors" => @result.parse_errors.map { |pe| { "file" => pe[:file], "error" => pe[:error] } },
         "security_findings" => @result.security_findings.map(&:to_h),
         "performance_findings" => @result.performance_findings.map(&:to_h),
+        "style_findings" => @result.style_findings.map(&:to_h),
         "duplicate_groups" => @result.duplicate_groups.map { |g| duplicate_group_hash(g) },
         "dependency_findings" => @dependency_findings.map(&:to_h)
       }
@@ -66,6 +67,7 @@ module Scryer
       rows = [CSV_HEADERS]
       h["security_findings"].each { |f| rows << static_csv_row(f) }
       h["performance_findings"].each { |f| rows << static_csv_row(f) }
+      h["style_findings"].each { |f| rows << static_csv_row(f) }
       h["dependency_findings"].each { |f| rows << dependency_csv_row(f) }
 
       rows.map { |row| row.map { |field| csv_field(field) }.join(",") }.join("\n")
@@ -75,7 +77,8 @@ module Scryer
       h = as_hash
       security = h["security_findings"]
       performance = h["performance_findings"]
-      all_findings = security + performance
+      style = h["style_findings"]
+      all_findings = security + performance + style
       by_severity = all_findings.group_by { |f| f["severity"] }
       duplicate_groups = h["duplicate_groups"]
       dependency_findings = h["dependency_findings"]
@@ -105,7 +108,7 @@ module Scryer
 
           <section id="summary">
             <h2>Summary</h2>
-            #{render_summary_table(security, performance, duplicate_groups, dependency_findings)}
+            #{render_summary_table(security, performance, style, duplicate_groups, dependency_findings)}
           </section>
 
           <section id="checks-performed">
@@ -185,19 +188,21 @@ module Scryer
       "<table class=\"kv\">#{body}</table>"
     end
 
-    def render_summary_table(security, performance, duplicate_groups, dependency_findings)
+    def render_summary_table(security, performance, style, duplicate_groups, dependency_findings)
       sec_counts = count_by_severity(security)
       perf_counts = count_by_severity(performance)
-      total_counts = SEVERITY_ORDER.each_with_object({}) { |s, acc| acc[s] = sec_counts[s] + perf_counts[s] }
+      style_counts = count_by_severity(style)
+      total_counts = SEVERITY_ORDER.each_with_object({}) { |s, acc| acc[s] = sec_counts[s] + perf_counts[s] + style_counts[s] }
 
       header = "<tr><th>Category</th>" + SEVERITY_ORDER.map { |s| "<th>#{SEVERITY_LABELS[s]}</th>" }.join + "<th>Total</th></tr>"
       sec_row = summary_row("Security", sec_counts)
       perf_row = summary_row("Performance", perf_counts)
+      style_row = summary_row("Style", style_counts)
       total_row = summary_row("Total", total_counts, css_class: "total")
       dup_row = "<tr><th>Duplicate code</th><td colspan=\"#{SEVERITY_ORDER.size}\">—</td><td>#{duplicate_groups.size} group(s)</td></tr>"
       deps_row = "<tr><th>Dependency audit</th><td colspan=\"#{SEVERITY_ORDER.size}\">—</td><td>#{dependency_findings.size} finding(s)</td></tr>"
 
-      "<table class=\"summary\">#{header}#{sec_row}#{perf_row}#{dup_row}#{deps_row}#{total_row}</table>"
+      "<table class=\"summary\">#{header}#{sec_row}#{perf_row}#{style_row}#{dup_row}#{deps_row}#{total_row}</table>"
     end
 
     def summary_row(label, counts, css_class: nil)
@@ -221,9 +226,11 @@ module Scryer
     def render_checks_performed
       security_rules = rules_by_category["security"] || []
       performance_rules = rules_by_category["performance"] || []
+      style_rules = rules_by_category["style"] || []
 
       "<h3>Security (#{security_rules.size})</h3>#{checks_table(security_rules)}" \
-      "<h3>Performance (#{performance_rules.size})</h3>#{checks_table(performance_rules)}"
+      "<h3>Performance (#{performance_rules.size})</h3>#{checks_table(performance_rules)}" \
+      "<h3>Style (#{style_rules.size})</h3>#{checks_table(style_rules)}"
     end
 
     def checks_table(rules)

data/lib/scryer/scanner.rb

@@ -26,7 +26,7 @@ module Scryer
     QUERY_SIMILARITY_THRESHOLD = 0.7
     CACHE_SIMILARITY_THRESHOLD = 0.7
 
-    Result = Struct.new(:security_findings, :performance_findings, :duplicate_groups, :files_scanned, :parse_errors, keyword_init: true)
+    Result = Struct.new(:security_findings, :performance_findings, :style_findings, :duplicate_groups, :files_scanned, :parse_errors, keyword_init: true)
 
     # `skip_rules` silences specific checks by rule_id (e.g. a known false
     # positive on this codebase) without editing/removing the rule itself —
@@ -44,6 +44,7 @@ module Scryer
       all_cache_calls = []
       security_findings = []
       performance_findings = []
+      style_findings = []
       parse_errors = []
 
       files.each do |abs_path|
@@ -69,6 +70,7 @@ module Scryer
             case rule_class.category
             when "security" then security_findings
             when "performance" then performance_findings
+            when "style" then style_findings
             end
           next unless bucket
 
@@ -97,6 +99,7 @@ module Scryer
       Result.new(
         security_findings: security_findings,
         performance_findings: performance_findings,
+        style_findings: style_findings,
         duplicate_groups: duplicate_groups,
         files_scanned: files.size,
         parse_errors: parse_errors

data/lib/scryer/style_rules/frozen_string_literal_rule.rb

@@ -0,0 +1,50 @@
+module Scryer
+  module Rules
+    # Flags Ruby files with no `# frozen_string_literal: true` magic comment
+    # — the one deliberate, narrow style check Scryer makes (see the
+    # README's Scryer-vs-RuboCop comparison: everything else in
+    # style/lint conventions is intentionally left to RuboCop). Checked on
+    # raw source rather than the parsed sexp — a magic comment is lexical,
+    # not part of the AST — so this only needs the file's leading lines,
+    # not Ripper.sexp.
+    class FrozenStringLiteralRule < Rule
+      self.rule_id = "frozen_string_literal"
+      self.category = "style"
+      self.default_severity = "info"
+      self.title = "Missing `frozen_string_literal` magic comment"
+
+      MAGIC_COMMENT = /\A#\s*frozen_string_literal:\s*(true|false)\s*\z/i.freeze
+
+      def scan
+        return [] if source.strip.empty?
+        return [] if leading_comment_lines.any? { |line| MAGIC_COMMENT.match?(line.strip) }
+
+        [
+          finding(
+            line: 1,
+            message: "This file has no `# frozen_string_literal: true` magic comment — every " \
+                      "string literal allocates a new String object at runtime instead of reusing " \
+                      "a single frozen one.",
+            suggested_fix: "Add `# frozen_string_literal: true` as the first line of the file " \
+                            "(after a shebang line, if any) — a cheap, safe default in modern " \
+                            "Ruby. If a specific literal needs to stay mutable, call `.dup` on it " \
+                            "explicitly at that call site."
+          )
+        ]
+      end
+
+      private
+
+      # The lines Ruby itself considers when looking for a magic comment:
+      # starting from the top of the file, skip a shebang line, then take
+      # every line up to (not including) the first line that isn't blank or
+      # a comment.
+      def leading_comment_lines
+        lines = source.each_line.to_a
+        lines.shift if lines.first&.start_with?("#!")
+
+        lines.take_while { |line| line.strip.empty? || line.lstrip.start_with?("#") }
+      end
+    end
+  end
+end

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/scryer.rb

@@ -15,6 +15,7 @@ require "scryer/ai_fix_suggester"
 
 Dir[File.join(__dir__, "scryer", "rules", "*.rb")].sort.each { |f| require f }
 Dir[File.join(__dir__, "scryer", "performance_rules", "*.rb")].sort.each { |f| require f }
+Dir[File.join(__dir__, "scryer", "style_rules", "*.rb")].sort.each { |f| require f }
 
 module Scryer
   class Configuration

data/lib/tasks/scryer.rake

@@ -9,32 +9,35 @@ require "fileutils"
 # Ruby nil-or-empty checks only.
 namespace :scryer do
   desc "Run Scryer and write a report. Args are any mix of json/html/csv (which formats " \
-       "to write — default json,html), the token 'deps' (fold a dependency audit — OSV.dev " \
-       "vulnerable gems + insecure git/http sources, same checks as scryer:audit_dependencies " \
-       "— into this report instead of running it separately), plus at most one path (a " \
-       "directory when writing more than one format, or an exact file for a single format). " \
-       "Rake splits bracket args on every comma, so pass each token as its own item rather " \
-       "than one comma-joined string. e.g. rails scryer:report, rails 'scryer:report[html]', " \
+       "to write — default json,html), the token 'nodeps' (skip the dependency audit — OSV.dev " \
+       "vulnerable gems + insecure git/http sources — that otherwise runs by default; use for a " \
+       "fast, fully offline run), plus at most one path (a directory when writing more than one " \
+       "format, or an exact file for a single format). Rake splits bracket args on every comma, " \
+       "so pass each token as its own item rather than one comma-joined string. " \
+       "e.g. rails scryer:report, rails 'scryer:report[html]', " \
        "rails 'scryer:report[json,doc/security.json]', rails 'scryer:report[json,html]', " \
-       "rails 'scryer:report[html,deps]', rails 'scryer:report[csv]'"
+       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]'"
   task :report, [:format] do |_, args|
     root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
     dirs = Scryer.configuration.dirs
 
     # Ignore the declared :format name and read every positional value Rake
     # was given (args.to_a) — the whole point is accepting a variable number
-    # of format/deps tokens plus one path, which a single named param can't do.
-    formats, path_arg, include_deps = parse_report_args(args.to_a)
+    # of format/nodeps tokens plus one path, which a single named param can't do.
+    formats, path_arg, run_deps = parse_report_args(args.to_a)
 
     skip_rules = Scryer.configuration.skip_rules
     puts "Scryer: skipping #{skip_rules.join(', ')}." if skip_rules.any?
 
     result = Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: skip_rules).call
 
+    # Dependency auditing (OSV.dev) runs by default — a single scryer:report
+    # run is meant to cover the same ground as RuboCop + Brakeman +
+    # bundler-audit + Reek run separately. Pass the 'nodeps' token for a
+    # fast, fully offline run instead.
     dependency_findings = []
-    if include_deps
-      puts "Scryer: checking Gemfile.lock sources (offline)..."
-      puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
+    if run_deps
+      puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
       dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root)
     end
 
@@ -65,12 +68,17 @@ namespace :scryer do
       File.write(path, content)
     end
 
-    puts "Scryer: #{result.files_scanned} files scanned, " \
-         "#{result.security_findings.size} security findings, " \
-         "#{result.performance_findings.size} performance findings, " \
-         "#{result.duplicate_groups.size} duplicate groups" \
-         "#{include_deps ? ", #{dependency_findings.size} dependency findings" : ""}."
-    puts "Report written to #{paths.values.join(', ')}"
+    ScryerTasks.print_summary(result: result, dependency_findings: dependency_findings, ran_deps: run_deps, paths: paths)
+
+    # Same gate as the `scryer` executable and scryer:audit_dependencies
+    # below: fail the task (and so the CI job running it) on any security or
+    # dependency finding, so `bin/rails scryer:report` gates a build the
+    # same way `brakeman` or `bundle-audit check` would. Performance/style
+    # findings are advisory only and never fail the task.
+    if result.security_findings.any? || dependency_findings.any?
+      abort("Scryer: found #{result.security_findings.size} security finding(s) and " \
+            "#{dependency_findings.size} dependency finding(s).")
+    end
   end
 
   desc "Check Gemfile.lock for known-vulnerable gem versions (via OSV.dev — needs network) " \
@@ -98,17 +106,17 @@ namespace :scryer do
 
   VALID_FORMATS = %w[json html csv].freeze
   EXTENSION_FOR_FORMAT = { "json" => "json", "html" => "html", "csv" => "csv" }.freeze
-  DEPS_TOKEN = "deps".freeze
+  NO_DEPS_TOKEN = "nodeps".freeze
 
   # tokens is every bracket arg Rake was given, e.g. %w[json doc/security.json] or
-  # %w[json html] or %w[html deps] or []. Returns [formats, path_arg,
-  # include_deps] — any token matching a known format is a format, the
-  # literal "deps" token opts into folding a dependency audit into the
-  # report, and at most one other token is allowed, which is the path.
+  # %w[json html] or %w[html nodeps] or []. Returns [formats, path_arg,
+  # run_deps] — any token matching a known format is a format, the literal
+  # "nodeps" token opts *out* of the dependency audit that otherwise runs by
+  # default, and at most one other token is allowed, which is the path.
   def parse_report_args(tokens)
     tokens = tokens.map { |t| blank_to_nil(t) }.compact
-    include_deps = tokens.any? { |t| t.downcase == DEPS_TOKEN }
-    tokens = tokens.reject { |t| t.downcase == DEPS_TOKEN }
+    run_deps = tokens.none? { |t| t.downcase == NO_DEPS_TOKEN }
+    tokens = tokens.reject { |t| t.downcase == NO_DEPS_TOKEN }
 
     format_tokens, other_tokens = tokens.partition { |t| VALID_FORMATS.include?(t.downcase) }
 
@@ -119,7 +127,7 @@ namespace :scryer do
     formats = format_tokens.map(&:downcase).uniq
     formats = %w[json html] if formats.empty?
 
-    [formats, other_tokens.first, include_deps]
+    [formats, other_tokens.first, run_deps]
   end
 
   # No path given: default filenames under tmp/. A path given with a single
@@ -169,4 +177,40 @@ module ScryerTasks
   rescue StandardError
     nil
   end
+
+  # The "one audit command" summary — a single scan's worth of every
+  # category Scryer covers (security, performance, duplicate/smelly code,
+  # dependencies), the same categories usually split across RuboCop +
+  # Brakeman + bundler-audit + Reek, side by side in one box.
+  def print_summary(result:, dependency_findings:, ran_deps:, paths:)
+    # "Code Quality" is the umbrella label for both duplicate-code groups
+    # and rule-based style findings (e.g. frozen_string_literal) — two
+    # different detectors, same broad concern, one row in the box.
+    code_quality = result.duplicate_groups.size + result.style_findings.size
+    deps_count = ran_deps ? dependency_findings.size : nil
+    total = result.security_findings.size + result.performance_findings.size + code_quality + (deps_count || 0)
+
+    rows = [
+      ["Security", result.security_findings.size],
+      ["Performance", result.performance_findings.size],
+      ["Code Quality", code_quality],
+      ["Dependencies", deps_count]
+    ]
+
+    divider = "─" * 32
+    puts ""
+    puts "Scryer Audit — #{result.files_scanned} files scanned"
+    puts divider
+    puts ""
+    rows.each { |label, count| puts summary_row(label, count) }
+    puts divider
+    puts summary_row("Total", total)
+    puts ""
+    paths.each { |format, path| puts "#{format.upcase} report: #{path}" }
+  end
+
+  def summary_row(label, count)
+    value = count.nil? ? "skipped (nodeps)" : "#{count} finding#{"s" unless count == 1}"
+    "#{label.ljust(14)}#{value.rjust(20)}"
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scryer
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Ram Laxman Yadav
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-10 00:00:00.000000000 Z
+date: 2026-08-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -25,23 +25,26 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '13.0'
 description: |
-  Scans a Rails app's own source with Ruby's stdlib Ripper parser (no Rails/bundler needed to
-  run the scan itself) and reports: security findings (SQL injection, mass assignment, command
-  injection, hardcoded secrets, unsafe deserialization, XSS-prone unescaped HTML, CSRF gaps,
-  weak crypto, open redirects), near-duplicate code (token-normalized similarity across
-  methods), and performance heuristics (N+1 queries, missing pagination, inefficient per-record
-  save loops, unbounded full-table iteration). Every finding includes a human-reviewable
-  suggested fix — nothing is auto-applied. Writes a detailed report as JSON and/or
-  self-contained HTML (tmp/scryer_report.{json,html}). Ships a `scryer` executable for
-  running outside a Rails app too, e.g. `scryer -o report.json -o report.html`. Also includes a
-  runtime query watcher (N+1 / unused-eager-load detection via ActiveRecord instrumentation,
-  opt-in) and a dependency vulnerability + insecure-source audit against OSV.dev.
+  One scan, one report: security, performance, duplicate-code, and dependency audits for Ruby
+  and Rails — the ground Brakeman, bundler-audit, Reek, and custom glue scripts usually split
+  between them, covered by a single `scryer` command. (Style/lint is RuboCop's job — Scryer
+  doesn't touch that.)
+
+  Detects SQL injection, mass assignment, hardcoded secrets, XSS, weak crypto, and more; N+1
+  queries, missing pagination, and other performance heuristics; near-duplicate code; and
+  known-vulnerable gems via a live OSV.dev dependency audit — on by default, every run.
+
+  Every finding includes a human-reviewable suggested fix — never auto-applied, optionally
+  rewritten against your actual code by any LLM you configure. Reports in JSON, self-contained
+  HTML, or CSV. Zero runtime dependencies beyond Ruby's own stdlib.
 email:
 executables:
 - scryer
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
+- LICENSE.txt
 - README.md
 - exe/scryer
 - lib/generators/scryer/USAGE
@@ -77,12 +80,18 @@ files:
 - lib/scryer/rules/weak_crypto_rule.rb
 - lib/scryer/rules/xss_unsafe_html_rule.rb
 - lib/scryer/scanner.rb
+- lib/scryer/style_rules/frozen_string_literal_rule.rb
 - lib/scryer/version.rb
 - lib/tasks/scryer.rake
-homepage: https://github.com/ramlaxmanyadav/scryer
+homepage: https://ramlaxmanyadav.github.io/scryer/
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/ramlaxmanyadav/scryer
+  documentation_uri: https://ramlaxmanyadav.github.io/scryer/
+  changelog_uri: https://github.com/ramlaxmanyadav/scryer/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/ramlaxmanyadav/scryer/issues
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -101,6 +110,6 @@ requirements: []
 rubygems_version: 3.5.11
 signing_key:
 specification_version: 4
-summary: 'Static code analysis for Rails apps: security vulnerabilities, duplicate
-  code, and performance heuristics.'
+summary: Ruby/Rails security & quality auditor — one command instead of Brakeman +
+  bundler-audit + Reek.
 test_files: []