Squashing Security Bugs with Rubocop
summary
Betterment uses RuboCop to ship custom RuboCop cops that match AST shapes with node_pattern and flag real issues like unsafe evals and unscoped model.find from params uses, not vague style advice. The work is about the actual checks implemented, the simple 20‑line cops that detect patterns, inline remediation messages, and keeping false positives low so teams accept them. Code is open sourced and tuned for developer experience.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:31Quick Introduction
- 1:05Static Analysis
- 4:54Node Pattern
- 5:37Wrapper for Node Pattern
- 8:00Anti-Patterns
- 8:46Auto Json Class
- 15:50Developer Experience
- 19:55Add Inline Remediation Advice
- 20:30Configuration Options
- 25:28Quick Resources
