Skip to content
Auditing the Ruby ecosystem's central package repository
blog.trailofbits.com | blog | #supply-chain | #ruby | #open-source | #rubygems | #security-audit | #trail-of-bits | #package-manager
Summary
Trail of Bits audited RubyGems.org for Ruby Central over five engineer-weeks, finding 33 issues including a high-severity StartTLS flaw and missing multi-party approval for production deployments.
- Published
- Collected