# Top five security tips

**URL:** <https://www.ruby-forum.com/t/top-five-security-tips/125975>\
**Category:** Rails\
**Created:** [January 14, 2008, 11:06am UTC](https://www.ruby-forum.com/t/top-five-security-tips/125975 "2008-01-14T11:06:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [January 14, 2008, 11:06am UTC](https://www.ruby-forum.com/t/top-five-security-tips/125975/1 "2008-01-14T11:06:15Z")

</div>

I’ve recently deployed my first app and although I don’t think I’ve done  
too much wrong I’m acutely aware of the importance of security. I’m sure  
people here are also.

I’d be interested in learning more and as such I thought I’d start a  
thread on the top five security mistakes (or gotchas I suppose) made by  
people, or just any pointers for things to watch out for. Either  
application based stuff or server configuration tips. I appreciate there  
are a heck of a lot more than five things, but hey, gotta start  
somewhere.

In my specific case, my app uses the original acts\_as\_authenticated  
plugin as well as the file\_column plugin (allows people to upload  
images). I’m hosted on joyent shared hosting (aka textdrive).

Top 5 security mistakes when deploying a new app.

1. errr, apply special permissions to databases.yml
2. …
3. …
4. …
5. …

Appreciate any tips.

---

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [January 14, 2008, 4:44pm UTC](https://www.ruby-forum.com/t/top-five-security-tips/125975/2 "2008-01-14T16:44:30Z")

</div>

any pointers ?

---

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [January 14, 2008, 4:51pm UTC](https://www.ruby-forum.com/t/top-five-security-tips/125975/3 "2008-01-14T16:51:03Z")

</div>

On 14 Jan 2008, at 15:44, bingo bob wrote:

> any pointers ?

Well you’ve cast quite a wide net, and it’s always hard to know at  
what level your pitching. So I can say ‘use h and sanitize where  
appropriate’, but I might be stating the bleeding obvious.

[http://www.quarkruby.com/2007/9/20/ruby-on-rails-security-guide](http://www.quarkruby.com/2007/9/20/ruby-on-rails-security-guide) has  
lots of good stuff (but it’s not quite up to date, eg it warns against  
using sanitize, recommending white\_list instead but in rails 2.0  
sanitize is white\_list)

Fred