Mitigate Rails security risks in web applications during code reviews and deployment.
npx skills add https://github.com/apdarr/lace --skill security-apdarr
Please help me install this Agent Skill. Skill: security Source: https://github.com/apdarr/lace/tree/main/.github/skills/security Command: npx skills add https://github.com/apdarr/lace --skill security-apdarr
This Skill provides structured, actionable guidance for securing Rails applications by addressing common web vulnerabilities such as XSS, SQL injection, CSRF, insecure file uploads, and command injection.
Review the Rails security standards and implement the recommended practices in controllers, views, and models to harden your application.
High-intent search queries and answers about installing and using this skill.
Prevent SQL injection in Rails by using parameterized queries, hash conditions, and safe LIKE patterns to stop data leakage and tampered queries. Avoid interpolating user input directly into database query strings.
Secure file uploads in Rails by validating content types and checking content bytes, preferring ActiveStorage, and restricting upload sizes. Validate uploads by content bytes rather than relying solely on file extensions.
Stop XSS vulnerabilities in Rails by escaping output and sanitizing user-generated content. Avoid bypassing Rails default escaping mechanisms when rendering user input in views to prevent cross-site scripting attacks.
Rails API CSRF protection fails when forms, headers, or fetch requests lack valid CSRF tokens. Ensure CSRF tokens are present in requests and implement Content Security Policy alongside safe request handling.
Prevent command injection in Rails by preferring safe command execution methods over shell interpolation and validating inputs. Avoid passing unsanitized user input directly to system command execution functions.
zerobearing2Enforce Rails security against XSS, CSRF, SQL injection, and unsafe file uploads.
augustoheissIdentify and remediate application security risks in web and cloud-native systems.
matteocervelliScan codebases for secrets, vulnerable dependencies, and insecure patterns.
Prohao42Identify WAF products and apply bypass techniques for penetration testing.
