Gems pulled from a git repository or a local path do not come from the registry as a published release, so a scanner has less to match against advisories. Treat each git or path gem as a manual review item, pin it to a tag or commit, and prefer a released version where one exists.
What the sources are
The Bundler Gemfile guide describes two source types besides the default registry:
- Git sources. A gem can be pulled from a git repository over HTTPS, SSH or the git protocol. You select a branch, a tag or a ref, but only one of them. The default is the master branch.
- Path sources. The path option points at a gem's unpacked source directory. Bundler does not compile C extensions for path gems.
In both cases the repository or directory needs a gemspec, or you must give a version explicitly.
Why this affects security work
Advisory databases for gems are written against published versions. A gem tracked on a branch has no fixed version number to compare, and the code can change on the next install if the lockfile is updated. A path gem is code in your own tree, which a registry advisory cannot describe at all.
That makes these entries easy to miss. They appear in the lockfile, but a version-based match may be weak or absent. Verify how your own scanner reports them rather than assuming.
Risks the Bundler guide calls out
The guide advises avoiding the http and git protocols for git sources, because they are unauthenticated and a man-in-the-middle attacker can deliver malicious code. HTTPS and SSH are preferred. It also notes that the github shorthand currently expands to an insecure git protocol URL, so it should be avoided. Check the current guide before you rely on that detail, since it may change.
A review checklist
- List every git and path entry in the Gemfile.
- For each git gem, switch to a tag or ref rather than a branch.
- Use HTTPS or SSH URLs.
- Ask whether a released version now exists, and move to it.
- Record who owns the repository and why the gem is not on the registry.
- For a path gem, put it under normal code review and static analysis, since it is your code.
- Run bundler in frozen mode in CI so the recorded revision is the one that builds. See our post on frozen mode.
Decision table
| Source | Registry advisory match | Better practice |
|---|---|---|
| Registry release | Strong | Keep, with lockfile |
| Git on a tag or ref | Weak, depends on the scanner | Move to a release when possible |
| Git on a branch | Weak, and code can move | Pin to a ref |
| Path | Not applicable | Review as your own code |
Quick check
Is a git source worse than a registry gem?
Not automatically. It is harder to match against advisories and easier to change by accident, so it needs more review.
Can I give both a branch and a tag?
No. The Bundler guide says only one of branch, tag or ref may be used.
Safeguard's SBOM and dependency scanning lists components from your lockfiles so you can see which ones are not plain registry releases. The free scan is a starting point.
Sources
Last reviewed: 19 October 2026.
