Three Common Design Pitfalls Behind Rails' March 2026 Security Update

On March 23, 2026, Rails released versions 7.2.3.1, 8.0.4.1, and 8.1.2.1, patching multiple CVEs spanning XSS, ReDoS, memory exhaustion, path traversal, and glob injection — its largest security update in recent years. Rather than walking through each CVE, this talk takes a step back: are there shared design pitfalls underneath? I'll pick the most representative cases and group them into three patterns: misplaced trust boundaries (mixing internal state with external input), filesystem APIs accepting unfiltered input (path traversal and glob injection), and "one fix isn't enough" — incomplete patches that get bypassed. Each pitfall comes with vulnerable code, how it was fixed, and a checklist you can apply directly to your project. No security background required.