rails-security-baseline

What problem does it solve?

AI coding agents writing Ruby on Rails code routinely introduce critical security vulnerabilities by default, including permissive strong params that allow mass assignment, disabled CSRF protection, insecure JWT configurations with secrets in payloads, wildcard CORS rules, and missing rate limiting. This skill encodes the production-grade security baseline that senior Rails developers use to prevent these flaws before they reach production.

Core Features & Use Cases

• OWASP Top 10 Rails Mapping: Direct, actionable defenses for each OWASP Top 10 vulnerability category tailored to Rails conventions.
• Secure Configuration Patterns: Step-by-step guidance for strong params, CSRF (browser apps and SPAs), CORS, Rack::Attack rate limiting, secure headers, and Rails credentials per environment.
• CI Security Tooling: Setup instructions for Brakeman, bundler-audit, and Dependabot to catch vulnerabilities automatically in continuous integration.
• Use Case: When adding a new user authentication controller, this skill ensures you implement explicit strong params, enable CSRF protection correctly, configure short-lived JWTs with refresh rotation, and add login rate limiting to prevent brute-force attacks.

Quick Start

Use the rails-security-baseline skill to audit your new payments controller for strong params, CSRF configuration, and credential handling before merging to main.