Do the Right Thing: Practical lessons for your..
summary
A concrete path from Rails defaults to measurable compliance: generate a Rails 8.1 app, scaffold a secrets resource, encrypt content column with Active Record encryption, filter parameters in logs, and use Brakeman, Dependabot, and Bundler Audit for CI. Add console-1984 and audits-1984 so the console requires justification and every access is recorded, then deploy Hypershield plus Blazer so reporting uses a Hypershield readonly reporting view that omits secret fields and enforces least privilege.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:03Compliance feels overwhelming
- 4:17Compliance as trust with Steve Cook
- 7:23Accountants view compliance
- 8:04Compliance as virtuous cycle
- 9:08SOC 2 with Rails and GitHub
- 12:22Rails features for compliance
- 14:51Protecting secrets in Rails
- 17:37Encrypting data in Rails
- 20:07Preventing console misuse
- 23:35Database access control
- 26:47Compliance controls with Rails
- 28:53Start small with compliance
- 29:16Q&A
related talks
42mSecuring Your Rails App
31mRails' Insecure Defaults
38m"Application Security for Rails Engineers"
31mRails Application Security in Practice
27mScaling Ruby Applications: Challenges, Solutions and Best Practices
42mPowerful Rails Features You Might Not Know
20mDefending Against Data Breaches, as a Practicing Ruby Developer
43mSecuring Your Site