With approximately five minutes of conversation with Thomas I was able to write a ~30 line Ruby script which successfully compromised $A_THING_OF_IMMENSE_VALUE

With approximately five minutes of conversation with Thomas I was able to write a ~30 line Ruby script which successfully compromised $A_THING_OF_IMMENSE_VALUE on a Rails app (my own, in staging) over the public Internet in a matter of seconds using no insider knowledge of that app's architecture. Thomas is being oblique with regards to the implications of this for a reason.