# Rails is secure

**URL:** <https://www.ruby-forum.com/t/rails-is-secure/87079>\
**Category:** Deployment\
**Created:** [February 28, 2007, 12:44am UTC](https://www.ruby-forum.com/t/rails-is-secure/87079 "2007-02-28T00:44:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![HSWebers](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/eb9ed0/32.png) [@HSWebers](https://www.ruby-forum.com/u/HSWebers)\
**Post date:** [February 28, 2007, 12:44am UTC](https://www.ruby-forum.com/t/rails-is-secure/87079/1 "2007-02-28T00:44:54Z")

</div>

Hi!

I think many of us share the perception of Rails being a “secure”  
framework.  
And that might well be true, because we need less code to get things  
done and  
less code means a better overview of what’s happening.  
But though Rails seems to be safer, doesn’t allow us to lean back.  
There has  
been a security bug in Rails last year and even in Ruby.

In fact most of the security issues with web sites or web applications  
don’t  
necessarily stem from the programming language or framework we use, but  
affect  
web applications in general.

I’ve therefore started a new web site about Ruby on Rails - it’s  
about the  
technologies around Rails and it’s about its security.

```
                  It's at http://www.rorsecurity.info/

```

I kindly ask you to take a look at it, put a link on your blog and tell  
others  
to spread the word and make Ruby on Rails THE secure framework.  
In the next few months I will address the secure configuration of web  
servers,  
how to securely set up MySQL, Rails and Subversion. Also the common  
attacks,  
such as SQL injection, Cross Site Scripting and many more, will be  
addressed,  
as well as its countermeasures.

Best regards,  
H. Webers  
[http://www.rorsecurity.info/](http://www.rorsecurity.info/)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![HSWebers](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/eb9ed0/32.png) [@HSWebers](https://www.ruby-forum.com/u/HSWebers)\
**Post date:** [February 28, 2007, 1:01am UTC](https://www.ruby-forum.com/t/rails-is-secure/87079/2 "2007-02-28T01:01:55Z")

</div>

Good idea. Some of us are now having to manage VPSs as part of our rails  
deployments and any rails focused information on securing them would be  
very  
welcome.

Cheers  
Hammed