Ruby on Rails Security Checklist

Rails auto-escapes HTML in ERB templates by default. Never use `raw()` or `html_safe` with unsanitized user content.

Use ActiveRecord query interface with parameterized conditions. Never use string interpolation in `where()` clauses.

Keep Rails' built-in CSRF protection enabled. Use `protect_from_forgery with: :exception` in ApplicationController.

Use Strong Parameters (`params.require(:model).permit(:field)`) to prevent mass assignment vulnerabilities.

Configure `force_ssl` in production to enforce HTTPS. Set `config.force_ssl = true` in `production.rb`.

Use `has_secure_password` with bcrypt for password handling. Never implement custom password hashing.

Use `rack-attack` gem for rate limiting and throttling. Block suspicious IPs and limit authentication attempts.

Keep `secret_key_base` secret and never commit it to version control. Use Rails credentials or environment variables.