Ruby on Rails Security

Over and over again we see plans for a new web app with the assumption some “security contractor” is going to come review any and all security problems introduced by the team doing the actual building of the application. Rarely does that security contractor get hired. And so security bugs linger. And even worse, the development team is taught that they don’t have to be vigilant about security.