Security

SQL injection Parameterized queries (?, $1), ORM query APIs. Never interpolate user input into SQL strings.

Command injection system("cmd", arg) with array arguments, Open3 with arrays, Shellwords.escape. Avoid backticks with user input.

Code injection Never eval, instance_eval(string), send(user_input), or constantize untrusted input. Use allowlists.

Unsafe deserialization Never Marshal.load / YAML.unsafe_load untrusted data. Use YAML.safe_load, JSON.parse.

Regexp.timeout, simple patterns, \A/\z anchors Escape output (ERB with <%= %> escapes in Rails; ERB::Util.html_escape elsewhere) Mass assignment

Strong parameters (permit/expect in Rails) Environment variables, Rails credentials, Vault. Never commit secrets (use gitleaks).

Vulnerable dependencies bundle audit (bundler-audit), Dependabot, gem update regularly Weak crypto/passwords

bcrypt/argon2 for passwords, SecureRandom for tokens, OpenSSL::Cipher AES-GCM, ActiveSupport::MessageEncryptor Timing attacks

Rack::Utils.secure_compare / OpenSSL.fixed_length_secure_compare File path traversal

File.expand_path + verify it's under the base directory. Sanitize filenames.

Open redirects / SSRF Validate URLs and hosts against allowlists

Tools: Brakeman (Rails static analysis), bundler-audit, RuboCop security cops, Semgrep, OWASP guidelines, gem cert signing and RubyGems MFA for publishing.