I personally have been turned off from it. Not that they have security issues, everyone does, it's the time required to roll out changes basically requires not

I personally have been turned off from it. Not that they have security issues, everyone does, it's the time required to roll out changes basically requires not just updating a library, but updating your framework since the line between your code and the framework can be extremely blurred. This means that if you have multiple rails sites with limited or no timely dev support you may not be readily able to upgrade your site to resolve issues. This is why I took down my personal blog I had built in rails since I didn't want to be exposed to these issues and didn't have the time or desire to uplift the site onto more recent versions of rails.