Folks still get the basics of Rails security wrong. Here’s a few big ones. I think it comes from too much reliance on assuming a “security engineer” will come in and pay attention. They never come.