ruzzy

Ruzzy is a coverage-guided fuzzer for Ruby built on top of libFuzzer. It is designed to help developers identify crashes, memory corruption, and undefined behavior in Ruby applications and Ruby C extensions. By integrating sanitizer support, Ruzzy enables security-focused testing workflows that can uncover vulnerabilities and stability issues that traditional testing may miss. It is particularly useful for projects that rely on native extensions or require robust fuzz testing capabilities within the Ruby ecosystem.

The tool supports fuzzing both pure Ruby code and Ruby C extensions. For pure Ruby applications, Ruzzy uses a tracer-based approach that requires separate tracer and harness scripts due to Ruby interpreter implementation details. For Ruby C extensions, a single harness file is sufficient. Ruzzy integrates with AddressSanitizer through environment configuration and supports deterministic harness design for reliable fuzzing results. Installation requires a recent version of clang and a supported Linux architecture, with optional debugging support available through environment variables. The project also provides toy examples and harness guidelines to help users validate setup and write effective fuzzing targets.

Ruzzy is intended for security researchers, Ruby developers, maintainers of Ruby gems with native extensions, and teams performing application hardening or vulnerability discovery. It is especially valuable when testing memory safety in C extensions or when coverage-guided fuzzing is needed for Ruby-based projects. Developers working on Linux environments who need production-ready fuzzing support for Ruby applications can use Ruzzy to improve software reliability and security testing workflows.