I did some digging for you, I am not the best at Rails but from my understanding, it seems to throw the queries into ActiveRecords QueryAttribute using bind par

I did some digging for you, I am not the best at Rails but from my understanding, it seems to throw the queries into ActiveRecords QueryAttribute using bind parameters [1]. So I'd say enough safe from sqli [2]. [1] https://github.com/ankane/blazer/blob/bd06aab33052783e84672bd6894e9533263a5e6e/lib/blazer/adapters/sql_adapter.rb#L27 https://github.com/ankane/blazer/blob/bd06aab33052783e84672b... [2] https://blog.saeloun.com/2019/10/28/bind-parameters-in-activerecord-sql-queries https://blog.saeloun.com/2019/10/28/bind-parameters-in-activ...