That is a partial option, but there are ways in which it is inadequate. For example, with the January Rails vulnerabilities, dropping an IMG tag with a well-co

That is a partial option, but there are ways in which it is inadequate. For example, with the January Rails vulnerabilities, dropping an IMG tag with a well-constructed URL on a site on the public internet was likely enough to suborn a developer's browser into connecting to and rooting a Rails box that was firewalled from external traffic. You still want to patch things, to prevent that and similar issues.