framework
Ruby on Rails is an open-source web application framework written in Ruby, prized for conventions that speed building database-backed apps.
No evidence-backed relationships are recorded.
David Heinemeier Hansson's agent-written Rust port of Campfire served 36,120 room-page requests a second to Rails' 217 in 37signals' own benchmark. A parity harness checks its behavior against Rails, but the numbers are company-run and stop short of production traffic.
Reality
37signals has made hand-written code an exception handled like a Sentry bug and is rebuilding HEY as six native apps on a Rust backend. DHH's line counts come from his own slides, so the policy and the rebuild are what an engineering lead can actually judge.
Reality
Stave flagged 47 security findings in the documented AWS defaults of Mastodon, Discourse and Chatwoot, according to a dev.to post. None of the three configures bucket encryption, access logging or Public Access Block, so whoever creates the bucket has to add them.
Reality
David Heinemeier Hansson said in his Rails World keynote that 37signals, the 27-year-old company behind Ruby on Rails, is done writing code by hand. Its stack now follows how well agents write each language, and other teams can measure that on their own code first.
Reality
One programmer ran the same bet on two codebases and got opposite results, which is closer to a controlled test than anything else in the agentic coding argument, and the published dates make it harder to read than it needs to be.
Reality
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
Perspective Coverage
4 publishersReality
Huntress ran seven Rails tasks past Claude Fable 5.1 and watched it copy hand-rolled code out of its own repository. Changing the harness, in three cheap steps, took API recall from 48 percent to 100.
Reality
The audioproxy-rails gem signs variant options into an audio tag's src and lets one container transcode on first request. That deletes the variants table and puts a failed encode inside a live request.
Reality
Aha!'s founders say the first, containerized version of Builder was too slow and expensive to scale, and the rebuild keeps authentication, SSO, databases and email out of generated code on cost and reliability grounds.
Reality
Compose has carried a restart flag on depends_on since 2023. A read-only pass over 38 running containers on eight servers found seven declared dependencies, all of them waiting on health and all of them recording restart as false.
Reality
Wiring the breaker_machines gem into a Rails app took an afternoon. Making a circuit actually open took a week. The decisions that survive are about which Redis database holds state and which integration sets its own threshold.
Reality
Rapid7 reproduced the Active Storage arbitrary file read on five Rails versions, then walked it through leaked signing material into remote code execution. Any app on 7.0 defaults taking untrusted uploads is a patch-now case.
Reality
Omarchy's patron ledger names twelve individuals and two companies and adds up to the dollar. The nonprofit meant to hold the trademarks has no jurisdiction, entity or headquarters on the record, and that is the part a fleet owner should be pricing.
Reality
Three simultaneous releases fix one flaw in image variant processing. Apps on 7.1 or earlier get no backport at all, so their remedy is a minor-version upgrade under the same clock as everyone else's.
Reality
Rails shipped fixes on July 29 in 7.2.3.2, 8.0.5.1 and 8.1.3.1. Whether your app is actually closed depends on the libvips version sitting on the host and on which features serve a processed image back to the uploader.
Reality
VulnCheck's ENDLESSDOORS ships enabled on more than 20 Zbtlink models and runs as root from boot, and because it opens no port at all, the check that would have caught it has to happen on the firmware image.
Reality
Rapid7 describes eleven of the sixteen additions, and eight of those are scanners rather than exploits. The unauthenticated file reads and SQL injections carry the real pressure this quarter, well ahead of the two Tenable modules.
Reality
A dev.to post walks through a Rails action that authenticates the caller and then loads any invoice by id. The defect is an absence, and the model's own tests confirm it.
Reality
A practitioner argues the 80% coverage norm was a budget for review time, not a standard, and that any check living only in the pipeline reports to you rather than constraining the agent.
Reality
A Chatwoot operator's postmortem shows the meter you inherit watches Postgres while attachments pile up on a Docker volume that grows with tenant count, not traffic.
Reality
Build · August 18, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher