You can use 3.2.12 with the security patches added, like Discourse is doing: https://github.com/discourse/discourse/commits/master/lib/freedom_patches/rails_se

You can use 3.2.12 with the security patches added, like Discourse is doing: https://github.com/discourse/discourse/commits/master/lib/freedom_patches/rails_security_fixes.rb https://github.com/discourse/discourse/commits/master/lib/fr... (to be used as an initializer)