This is very true if you don't actually understand and/or couldn't implement the magic yourself. As someone who has had to implement CSRF protection, cookie man

This is very true if you don't actually understand and/or couldn't implement the magic yourself. As someone who has had to implement CSRF protection, cookie management, etc., from scratch in other languages/frameworks, it's just a pure productivity boost when I use something rails-based. Where you can really get into trouble is if you take rails things for granted, and then go to a framework in another language. For example, you could have been brought up on rails and just take for granted that cookies are encrypted by default, and not realize that your supposedly server side cookie secrets stuff in express is being set in plain text. What I like about rails, though, is it tries really hard to stop you from doing something stupid. Strong Params is a great example of that. You have to really fight ActionController to get it to do something actually unsafe. By that same token, properly configured rubocop will catch 100% of potential SQL injection vulnerabilities.