presidentbeef/brakeman · error · Brakeman::NoApplication

Please supply the path to a Rails application (looking in #{

Error message

Please supply the path to a Rails application (looking in #{@app_tree.root}).
  Use `--force` to run a scan anyway.

What it means

At startup, `Brakeman::Scanner` builds an `AppTree` from the given path and requires the target to look like a Rails application: a root that contains an `app/` directory. If no usable root is found or `app/` is missing, and `--force` was not passed, it raises `Brakeman::NoApplication` with this guidance message instead of scanning something that would yield meaningless results.

Source

Thrown at lib/brakeman/scanner.rb:30

  $stderr.puts e.message
  $stderr.puts "Please install the appropriate dependency."
  exit(-1)
end

#Scans the Rails application.
class Brakeman::Scanner
  attr_reader :options

  #Pass in path to the root of the Rails application
  def initialize options, processor = nil
    @options = options
    @app_tree = Brakeman::AppTree.from_options(options)

    if (!@app_tree.root || !@app_tree.exists?("app")) && !options[:force_scan]
      message = "Please supply the path to a Rails application (looking in #{@app_tree.root}).\n" <<
                "  Use `--force` to run a scan anyway."

      raise Brakeman::NoApplication, message
    end

    @processor = processor || Brakeman::Processor.new(@app_tree, options)
  end

  #Returns the Tracker generated from the scan
  def tracker
    @processor.tracked_events
  end

  def file_cache
    tracker.file_cache
  end

  def process_step(description, &)
    Brakeman.process_step(description, &)
  end

View on GitHub (pinned to 649e678d0a)

Solutions

Point Brakeman at the actual Rails root: `brakeman ~/work/monorepo/services/web` or cd into the app directory first.
If the target genuinely has no `app/` but you still want a scan (e.g. an engine or plain Ruby with ERB templates), opt in explicitly with `--force`.
In CI, set the job's working directory (e.g. `defaults.run.working-directory` in GitHub Actions) to the Rails app path so bare `brakeman` invocations resolve correctly.

Example fix

# before (run from monorepo root, Rails app is nested)
brakeman   # => Brakeman::NoApplication: Please supply the path to a Rails application...

# after (scan the actual Rails root)
brakeman services/web
# or force a scan of a non-standard tree
brakeman --force

Defensive patterns

Strategy: validation

Validate before calling

# Ruby, check Rails-app shape before scanning
path = ENV['RAILS_ROOT'] || Dir.pwd
unless File.directory?(File.join(path, 'app'))
  abort "#{path} is not a Rails app root (no app/ directory). Pass the Rails root or use --force."
end
Brakeman.run :app_path => path

Try / catch

begin
  Brakeman.run :app_path => path
rescue Brakeman::NoApplication
  # Non-standard layout: opt in to a forced scan
  Brakeman.run :app_path => path, :force_scan => true
end

Prevention

Invoke brakeman from the Rails app root, and in CI set the job's working directory to that root (monorepos especially).
For engines or app-less trees, make `--force` an explicit, documented decision rather than a reflex.
Gate wrapper scripts with a File.directory?(File.join(path, 'app')) check to fail fast with a clearer message.

When it happens

Trigger: Running `brakeman` in a directory that is not a Rails app root: the repo root of a monorepo where the Rails app lives in a subdirectory; a subfolder of the app (e.g. `app/` or `config/` itself); passing a wrong path argument; a project using a nonstandard layout without an `app/` directory.

Common situations: Monorepos where CI's default working directory is the repository root, not the Rails app; scanning Rails engines or gems that only contain `lib/`; directory structures with `app` renamed or mounted elsewhere; typos in the path argument in CI job definitions.

Related errors

AI-assisted analysis of presidentbeef/brakeman@649e678d0a (2026-08-21). Data as JSON: /api/errors/394b16ca5325821e. Report an issue: GitHub.