Geez, if you know so much about security then why are you asking us? In all seriousness, I wholeheartedly agree with Patrick. A given platform (ASP.NET or Ruby

Geez, if you know so much about security then why are you asking us? In all seriousness, I wholeheartedly agree with Patrick. A given platform (ASP.NET or Ruby On Rails) will not be a dominating factor. It's about whether or not you know about risks involved in writing web applications and how you mitigate against it as a developer. If you don't know what you are doing, both .NET and Ruby On Rails solutions will be vulnerable to SQL Injection, CSRF, XSS etc.