The thing that bothers me about Rails is how much stuff is "on" by default. I like to have enabled every single accessible endpoint in my apps by hand to avoid

The thing that bothers me about Rails is how much stuff is "on" by default. I like to have enabled every single accessible endpoint in my apps by hand to avoid security issues. I'd love for there to be a variant of Rails or even just an add-on that made a Rails app totally "mute" and then you had to enable every tiny thing by hand or in a config file so you knew every single vector into the app and what dependencies there were. Rails has had enough security issues for me to be that paranoid, and at least with Sinatra, I have a bit more work to do but I know I've tested every single hole I opened up.