While we're on the topic of static analysis of code that uses Rails... I suggest also using other static analysis tools as they make sense. I lead the Railroader project, an open source security static analysis tool for programs built on Rails. It doesn't guarantee finding all security problems, but it can help. More info here: https://railroader.org/