Brakeman will not check all gem dependencies and is not a general-purpose gem dependency security checker... bundler-audit will probably end up being the de facto tool for that: https://github.com/postmodern/bundler-audit