I believe you've accidentally omitted the following important and relevant pieces from the article and the following author comments: "There are other exploita

I believe you've accidentally omitted the following important and relevant pieces from the article and the following author comments: "There are other exploitable scenarios, but it really depends on what your app is doing. Since it is impossible to prove that something isn’t insecure, you should take the vulnerability seriously and upgrade anyway even if you think you aren’t affected." - article subsection "Summary: what is this vulnerability?" "a leaked key is NOT necessary to exploit the bug" - author comment on the article. "Another (unrelated) Rails vulnerability has been found today. That vulnerability has not been publicized yet, but suffice to say it is a very embarrassing and serious vulnerability that deserves immediate attention. Please keep your eye open on future advisories." - author comment on the article. "Not disagreeing with you there. After all there's no way to prove that something doesn't exist. What's why I wrote that everyone should upgrade, just in case. :) The goal of the article is not to defend Rails. It is to inform about the nature of the vulnerability and to replace the feeling of panic with rational thoughts." - author comment on HN