Ruby on Rails 8.0

Apply the Ruby 3.4 baseline first. These rules cover Ruby on Rails 8.0 parameters, Active Record, authorization, authentication, sessions, CSRF, views, SQL, redirects, files, jobs, secrets, errors, and deployment.

Requests and parameters

• Prefer params.expect(...) so required scalar/hash shape and permitted fields are checked together; never use permit! or an empty-hash permission for attacker-controlled nested data.
• Bind requests to narrow command objects when validation or authorization differs from the persistence model.
• Reject unexpected fields, oversized arrays, deep nesting, ambiguous encodings, and conflicting identifiers.
• Normalize route, query, header, cookie, and form values before security decisions.
• Set request, multipart, upload, decompression, pagination, and timeout limits before expensive work.

Active Record and authorization

• Scope every query, association, update, destroy, and background lookup to the authorized tenant or owner.
• Authorize the concrete record and transition in controllers or services and never trust possession of an ID.
• Keep IDs, tenant, ownership, roles, status, price, and audit fields out of client-controlled assignments.
• Use parameterized query conditions and allowlist dynamic columns, orders, directions, and SQL fragments.
• Treat unscoped, unscope, update_all, delete_all, insert_all, raw SQL, and administrative connections as privileged paths because callbacks, scopes, and instance checks may not run.

Authentication, sessions, and CSRF

• With has_secure_password, retain its password