#2041·brakeman

False Positive: Regexp containing an escaped $ is marked unsafe

Author: timdigginsCreated Aug 21, 2026Updated Aug 21, 2026

Background

Brakeman version: v8.0.6 Rails version: 8.0.5.1 Ruby version: 3.4.9

Link to Rails application code: N/A (at present)

False Positive

Full warning from Brakeman:

Confidence: High
Category: Format Validation
Check: ValidationRegex
Message: Insufficient validation for `survey_url` using `/\$AID/`. Use `\A` and `\z` as anchors
File: app/models/task.rb
Line: 118

Relevant code:

ruby
  validates :survey_url, format: { with: /\$AID/, message: "must contain $AID" }

Why might this be a false positive?

The $ is actually escaped (\$) and doesn't represent an end of line, so doesn't need substituting with \z