I was finishing the authentication PR for Ledgerly , an invoicing app I'm building in the open with Rails 8. Tests green, lint green. Then the security scan failed. The PR didn't add or update any gem.

It failed again two days later, on a different commit, for a different reason.

Nothing was broken in my code. What changed was the list of known vulnerabilities: new advisories had come out for gems the app was already using. The scan compares your Gemfile.lock against a public database that gets updated every day, so a build can go red without anyone touching anything.

What it found

I ran bundler-audit against the lockfile from before the fix: 44 advisories across 11 gems.…