Things I've written down.
Ruby, Rails, performance, security and applied machine learning. Updated when something feels finished.
A CSP that actually stops XSS
Most content security policies are decorative. The directive that matters is script-src, and 'unsafe-inline' undoes the whole thing.
Authenticated is not authorised
The most common real-world web vulnerability isn't injection. It's an endpoint that checks who you are and forgets to check what you may touch.
Prompt injection isn't XSS, but it rhymes
Both come from mixing instructions with data. The difference is that there is no escaping function for English.
What's actually in your session cookie
Rails signs the session cookie, so users can read it but not forge it. That distinction decides what may go in it.
Your dependencies are your attack surface
A modest Rails app pulls in a hundred-odd gems and several hundred transitive ones. Almost none were chosen by anyone.
Where SQL injection still lives in Rails
Active Record parameterises almost everything. The gaps are specific, well known, and exactly where people write raw fragments.
Rate limiting the endpoints that actually get abused
Blanket limits annoy real users and barely inconvenience attackers. The endpoints worth protecting are a short, specific list.
Secrets that stay secret
The dangerous part is not storage. It's that a secret in git history is still there after you delete the file — and .gitignore won't save you.
Your logs are a database nobody secured
Logs are copied to aggregators, retained for months and read by people who would never be granted access to the production database.