Rails Security Baseline

Ship a Rails 8 app without the obvious vulnerabilities. AI agents introduce common security bugs by default: permissive strong params, CSRF disabled with protect_from_forgery null_session "to make it work", JWTs with secrets in payload, CORS wildcards. This skill encodes the floor.

Why this matters

A web app is an attack surface. Every default that ships is a potential vulnerability if mis-wired. Rails defaults are mostly good but a single misconfiguration can leak data, hijack sessions, or grant admin. This skill names the patterns and the mistakes.

The opinion

Strong params with require + explicit permit keys. CSRF on for browser apps, bearer tokens for cross-origin APIs. Brakeman + bundler-audit + Dependabot in CI from day one. Rails credentials per environment, master keys in env vars. JWTs short-lived (5-15 min) + refresh tokens with rotation. CORS with explicit origins (never * for authenticated endpoints). Rack::Attack on login, signup, password reset. secure_headers gem for CSP / HSTS / X-Frame-Options.

The OWASP Top 10 → Rails mapping

See references/owasp-rails-mapping.md for the full breakdown. Quick reference: