I recently spent some time looking at application security on an old and new (Rails 3) app. Below is short (rather long) summary of my findings. Quick caveat, this is by no means meant to be an exhaustive post on Rails security (for that I’d recommend you read the official Ruby On Rails Security Guide) I’ve basically highlighted what I think are the bare minimum of checks you should be doing befor