AuthZ
APPSEC
APPSEC
Killing IDORs in Rails Applications: Make the Database Say "No" By Default
Rails is great at making the happy path simple. You need a record, you write Model.find(params[:id]). You need an authorization check, ...