Ruby Security Best Practices
Ship features with a secure-by-default mindset. Combine input validation, safe serialization, least-privilege permissions, and continuous monitoring to protect users and data.
Input validation & output encoding
- Whitelist parameters with strong parameters or dry-validation schemas. Reject unexpected fields.
- Escape user-generated content by default (`ERB` autoescape, `sanitize` for rich text).
- Normalise data before storing (downcase emails, strip whitespace) to avoid ambiguous comparisons.
OWASP Top 10 mapping
| Risk | Mitigation in RubyDev |
|---|---|
| Injection | Parameterised queries, whitelisting, `public_send` with allow-lists |
| Broken auth | Devise, bcrypt, ratelimits, session timeouts |
| Sensitive data exposure | HTTPS everywhere, filtered logs, encrypted credentials |
| Security misconfiguration | Security headers, CSP, locked-down container images |
Operational checklist
- Enable `config.force_ssl`, HSTS headers, and modern TLS versions in production.
- Rotate credentials regularly and keep secrets in the managed vault (Rails encrypted credentials + cloud secret store).
- Automate dependency vulnerability scans (Dependabot, bundler-audit) and patch within agreed SLA.
- Instrument security-focused alerts (unexpected admin login, mass export) and perform quarterly tabletop drills.