> One of the RoR vulnerabilities is connected to Mass assignment capabilities, which enables attackers to alter values in database columns and create new record

> One of the RoR vulnerabilities is connected to Mass assignment capabilities, which enables attackers to alter values in database columns and create new records in tables. But seasoned ROR developers can easily minimize risks in that case. This hasn't been the case for some time. By default, you can't pass in raw parameters from a request in a controller into a model. You have to either allow-list specific fields or create a hash from the parameters. You have to intentionally bypass this security feature to get a vulnerability. Recommend using brakeman to catch these kinds of mistakes. :)