It's as secure as you make it or the language allows: brakeman, bundler-audit, defensive coding, and thorough testing and fuzzing. The biggest problems are the

It's as secure as you make it or the language allows: brakeman, bundler-audit, defensive coding, and thorough testing and fuzzing. The biggest problems are the ability to change anything, anywhere at runtime and lack of a gradual type system that Python already has (py gives me a verbosity headache, but whatever). (Crystal already looks and feels like what Ruby 3.0 promises to be with a gradual type-system, and it's compiled.) Unfortunately, RoR is on the decline as trend-hoppers jump around to Express, Phoenix (Elixir), Gotham (Rust), Gin (Go) and so on. There are other interesting platforms like Amber (Crystal - compiled Ruby-alike) and Pony. If you want a mature, swiss-army bulldozer like Apache HTTPd and don't care about resource usage, then RoR is fine. OTOH, the problem with "new" web frameworks is they rarely, if ever, have the optimizations, features, attention to security or thorough testing that a large, stable framework does. YMMV. https://insights.dice.com/2019/03/13/ruby-programming-jobs-serious-decline/ https://insights.dice.com/2019/03/13/ruby-programming-jobs-s...