I like the part where the Rails developer says: The user has a flag to secure by default, I personally think that is enough. https://github.com/rails/rails/iss

I like the part where the Rails developer says: The user has a flag to secure by default, I personally think that is enough. https://github.com/rails/rails/issues/5228#issuecomment-4300062 https://github.com/rails/rails/issues/5228#issuecomment-4300... In other words, Rails actually does have a flag to make the mass assignment feature secure by default. But this flag defaults to 'false'. https://github.com/rails/rails/pull/4062/files#diff-1 https://github.com/rails/rails/pull/4062/files#diff-1