Ruby / Rails source review

When it applies

Reviewing Ruby source, usually Rails. Rails is safe by default in many places, so the bugs cluster in dynamic dispatch, mass assignment gaps, raw SQL, and unsafe deserialization/rendering.

Why it works

Ruby's metaprogramming (send, constantize, eval) turns strings into method/class/code references, and Rails helpers have unsafe escape hatches (.html_safe, where("...#{x}..."), render inline:). Tracing params to these is the whole game — and Brakeman automates the first pass.