About RailsHealth

It's run by one person. Here's who, and why.

Rob Bazinet, founder of RailsHealth.
Name:
Rob Bazinet
Location:
Connecticut
Rails since:
2007
GitHub:
rbazinet

I'm Rob Bazinet. I've been writing Ruby on Rails since 2007 — that's the 1.2 era, before Bundler, when you still installed plugins with script/plugin install from a Subversion URL and "deploying" meant cap deploy and praying. I've been around long enough to inherit a lot of Rails apps written by other people, and that's most of how I think about this product.

For the last several years a lot of my work has been the same shape. A team hands me a Rails repo — sometimes a contractor's leftover, sometimes a company's only app, sometimes both — and asks some version of: how bad is it, and what do we do first. So I'd clone it, run the same checks in the same order, write up the same kind of report. Gem CVEs from bundler-audit. brakeman output worth triaging. Whether there were any tests, and whether anyone was running them. Whether the production config was actually hardened. Whether there were missing indexes the size of a freight train. Whether anybody was watching for errors.

It took about a week, every time, and the answer was always similar: a long list, prioritized, with the security issues at the top because that's where ignorance hurts most. The work was repeatable, which is software-developer code for "this should be a program, not a person."

RailsHealth is that program. Eleven scanners, the same checks I was doing by hand, run weekly against a repo you connect via GitHub OAuth, scored on a 0–100 scale, presented in a report you can actually hand to a CTO or a client without translating it first.

It's run by one person — me — and that's deliberate. There are no outside investors. There's no exit plan. The only reason I'd ever shut this down is if it can't pay for itself, and if that ever happens you'll get notice in time to export your scan history and disconnect cleanly. I'm not going to pretend RailsHealth is a bigger team than it is. It's me. That's the trade — what you give up in scale, you get back in accountability.

What I commit to

  • Read-only access to your repos, nothing more. RailsHealth requests the minimum GitHub OAuth scope it needs to read the file tree and a small set of config files. We never write to your repo, never open issues or PRs, never push anything.
  • Static analysis only. We don't run your code. We don't install your gems. We don't run your tests. We read Gemfile.lock, schema.rb, CI configs, a handful of dotfiles — that's it.
  • We don't store your source. We store the analysis results (the findings, the score history) and the small set of config files we needed to produce them. Not your application code.
  • Your scan history is yours. You can export it and disconnect at any time. If you delete your account, the scan results and the cached config files go with it.
  • You can revoke us in one click in GitHub. No support ticket required.

What I won't do

  • I won't ask for write access to your repos. There's no version of this product that needs it. If a future feature ever did, it would be a separate, optional scope you grant deliberately — never silently expanded.
  • I won't train an AI model on your code or your scan results. Not mine, not anyone else's.
  • I won't sell your scan data, your repo names, or anything else identifiable, in aggregate or otherwise. The public scoring stats on the homepage are from named OSS projects (Discourse, Mastodon, Forem, OpenProject, Errbit, Diaspora) — that's the only "data product" this will ever ship.
  • I won't take outside investment that puts pressure on me to break any of the above.

Questions about how this works, what we read, what we don't — email support@stillriversoftware.com. I read every message.

Feedback