Security & Privacy
Building production systems that hold up under hostile traffic, browser quirks, and regulator-grade scrutiny.
The security gate that defaulted to off
Our docs called the bot challenge mandatory. The env flag behind it defaulted to false in the deploy config, so a routine deploy would ship the gate down.
Our rate limits were bypassed by a trailing slash
Five tuned Rack::Attack throttles, all matching the path exactly. Rails normalised the path after they ran, so a dot-json or a trailing slash bypassed every one.
Treat model output like user input
When strangers write the prompt and the answer renders on your page, you have two untrusted boundaries back to back. The layered posture we settled on.
Layered bot defense for a public form: honeypot, Turnstile, email verification, and the pieces between
A public, unauthenticated form that writes to the database and sends email is a bot's favorite denial-of-service target. No single control is enough. The point is layering honeypot, Turnstile, rate limiting, and email verification so one layer failing doesn't sink the rest.
Moving JWTs out of localStorage: the surprises waiting in ActionController::API
A JS-readable token in localStorage is one XSS away from account takeover. Moving it into an HttpOnly cookie is the well-known fix but ActionController::API has no cookies, no CSRF, and a few other surprises waiting on the first commit.
CSP nonces vs. 'unsafe-inline': the silent override that broke our admin UI
A nonce and 'unsafe-inline' in the same CSP directive: the browser silently drops 'unsafe-inline' by spec. Debugging a policy that quietly broke production.
