False Positive: Regexp containing an escaped $ is marked unsafe
Author: timdigginsCreated Aug 21, 2026Updated Aug 21, 2026
Background
Brakeman version: v8.0.6 Rails version: 8.0.5.1 Ruby version: 3.4.9
Link to Rails application code: N/A (at present)
False Positive
Full warning from Brakeman:
Confidence: High
Category: Format Validation
Check: ValidationRegex
Message: Insufficient validation for `survey_url` using `/\$AID/`. Use `\A` and `\z` as anchors
File: app/models/task.rb
Line: 118Relevant code:
validates :survey_url, format: { with: /\$AID/, message: "must contain $AID" }Why might this be a false positive?
The $ is actually escaped (\$) and doesn't represent an end of line, so doesn't need substituting with \z
Source: presidentbeef/brakeman