Rails Security at Scale
summary
Shopify runs ~150 deploys a day for ~800,000 merchants and describes concrete defenses: a RuboCop rule flagging html_safe, a GitHub bot called Caution Tape Bot that blocks unsafe PRs, the erb-lint gem for JS-context escaping, and an open source activerecord-firewall that turns indirect object access into errors. Watchtower scans exposed endpoints, a bug bounty finds complex multi-PR bugs (one paid $25,000) and fixes roll out in under an hour, while Learn-to-Hack workshops and a year‑round CTF actually raise developer skill.
AI-written summary · about
chapters (6)
- 0:00Start
- 5:13Problem - XSS (Cross-Site Scripting)
- 11:49Problem - CSRF
- 15:03activerecord-firewall
- 18:30Watchtower
- 24:57Learn to Hack Workshops
