About RailsHealth

I'm Rob Bazinet. I've been writing Ruby on Rails since 2007. That's the 1.2 era, before Bundler, when you installed plugins with script/plugin install from a Subversion URL and deploying meant cap deploy and hoping. I've been around long enough to inherit a lot of Rails applications written by other people, and that is most of how I think about this work.

For years a large part of my work has had the same shape. A team hands me a Rails repository, sometimes a contractor's leftover, sometimes a company's only application, sometimes both, and asks some version of: how bad is it, and what do we do first? So I would read it, run the same checks in the same order, and write up the same kind of report. Gem CVEs. Brakeman output worth triaging. Whether there were tests, and whether anyone was running them. Whether the production configuration was hardened. Whether the database was missing indexes. Whether anybody was watching for errors.

The collecting part of that work was the same every time, so I turned it into software. RailsHealth runs eleven automated checks against a repository and produces the evidence in minutes instead of days. What it can't do is the part a client actually pays for: deciding which findings matter for this application, grouping them into work a team can schedule, putting a number of developer-days on each, and saying what to do first. That part is me.

So the audit is a fixed-price engagement: five business days, $2,500, one application, a written report. The tooling makes it thorough and consistent. I make it useful to the person who has to decide what to spend.

It's one person, and that's deliberate. There are no outside investors and nobody else touches your code. When you email, you get me. When the report says something, I wrote it and I'll explain it. What you give up in scale you get back in accountability.