bundler.io has a very good explanation[1]:

After developing your application for a while, check in the application together with the Gemfile and Gemfile.lock snapshot. Now, your repository has a record of the exact versions of all of the gems that you used the last time you know for sure that the application worked. Keep in mind that while your Gemfile lists only three gems (with varying degrees of version strictness), your application depends on dozens of gems, once you take into consideration all of the implicit requirements of the gems you depend on.

This is important: the Gemfile.lock makes your application a single package of both your own code and the third-party code it ran the last time you know for sure that everything worked. Specifying exact versions of the third-party code you depend on in your Gemfile would not provide the same guarantee, because gems usually declare a range of versions for their dependencies.

1) http://bundler.io/v1.7/rationale.html#checking-your-code-int...

I suspect recursive is pointing out that if you don't know what a gemfile.lock is, then the site is not useful or easy to understand.

It's a file which Ruby on Rails uses to keep track of currently used gem versions. Gems are just Ruby libraries.

So the app just runs through the list and check whether version of the gem is vulnerable or not.

It's what ruby uses to "pin" the dependencies for a project.