This looks to be specific to the AuthLogic gem for authentication. I've been doing Rails development for 7 years and I have yet to see AuthLogic in the wild.

This looks to be specific to the AuthLogic gem for authentication. I've been doing Rails development for 7 years and I have yet to see AuthLogic in the wild. Devise is by far the most widely implemented auth system for a Rails app. So, to see this you must: 1. Have a Rails App 2. Be using AuthLogic for logins 3. Have let someone access your app's secret key. This still is a bad bug, but the instances of this bug being used in an attack are going to be very few.