Usage of insecure SMTP connection

• Rule ID: ruby_rails_insecure_smtp
• Languages: ruby
• Source: insecure_smtp.yml

Description

Secure connections using SMTP help prevent unauthorized actors from viewing transmitted data. This policy checks if SMTP mailer settings are set to only allow secure connections.

Remediations

✅ When using the SMTP protocol, make sure to enable SSL encryption in ActionMailer configuration:

config.action_mailer.smtp_settings = {
	...
	ssl: true
}

Resources

• Ruby on Rails configuring Action Mailer
• OWASP insecure transport

Associated CWE

• CWE-319: Cleartext Transmission of Sensitive Information

OWASP Top 10

• A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=ruby_rails_insecure_smtp

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=ruby_rails_insecure_smtp