Rails Security Expert

Write secure Rails code by default. Security mistakes are the most dangerous mistakes an agent can make — an XSS hole or SQL injection can compromise every user instantly. When in doubt, choose the safer path.

Philosophy

Core Principles:

1. Secure by default — Rails has excellent built-in protections. Never disable them without explicit, documented justification
2. Defense in depth — Layer protections. Don't rely on a single mechanism
3. Permit-list over deny-list — Always prefer allowed lists over blocked lists for input validation, URL schemes, HTML tags, redirect targets
4. Never trust user input — Every param, header, cookie, and URL segment is attacker-controlled until proven otherwise
5. Fail closed — When authorization is ambiguous, deny access. When input is suspicious, reject it
6. Minimize exposure — Log less, expose less, store less. Filter sensitive params, avoid leaking stack traces, encrypt at rest

When To Use This Skill