Search results

Safelist params passed to .ransack(...) to mitigate querying of sensitive associated data

Status: Open.

#90 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Feb 4, 2025

Use bundler's gem checksum verification

Status: Open.

#89 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Dec 20, 2024

Enforce email encryption: use enable_starttls not enable_starttls_auto

Status: Open.

#88 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Dec 13, 2024

Sensitive data in logs: Check ActiveRecord::Base.filter_attributes has intended value, it is brittle

Status: Open.

#87 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Jan 1, 2024

Setup GitHub's CodeQL scanner on repo to find vulnerabilities

Status: Open.

#86 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Nov 3, 2023

Turbo signed-stream-name never expires

Status: Open.

#85 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Sep 11, 2023

Beware ransack < v4 insecure defaults

Status: Open.

#84 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Aug 30, 2023

Consider setting config.active_storage.draw_routes = false in production, if not used

Status: Open.

#82 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Mar 23, 2022

On logout, sessions should be invalidated to mitigate stolen cookie attacks

Status: Open.

#81 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Jan 26, 2022

Protect against open redirects

Status: Open.

#80 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Aug 9, 2021

Invalidate sessions on logout

Status: Open.

#79 In eliotsykes/rails-security-checklist;

· eliotsykes opened on Jul 28, 2021

Mitigate Host Header Attacks

Status: Open.

#78 In eliotsykes/rails-security-checklist;

· eliotsykes opened on May 6, 2021