It may not be mentioned in the beginner docs... I feel ok insisting that professional software developers read more than an intro to the framework they are usin

It may not be mentioned in the beginner docs... I feel ok insisting that professional software developers read more than an intro to the framework they are using. Also not mentioning it isn't the same as avoiding it 'at all costs'. To continue the analogy: Sales person says "Look how fast this Ferrari can go!", then later, in the manual, "Drive at a responsible speed given your local laws, etc." All that said I do actually think that changing the default to be more annoying and more safe is a good thing (and it's been done https://github.com/rails/rails/commit/06a3a8a458e70c1b6531ac53c57a302b162fd736 https://github.com/rails/rails/commit/06a3a8a458e70c1b6531ac...). Just saying that I agree with raganwald -- this isn't even close to a 'security vulnerability'.