Railsmine Ruby on Rails consulting kontak@kaklabs.com

Rails work, done at depth.

I am Aji, an independent Ruby on Rails consultant with an application security background. I upgrade, audit, speed up, and build Rails applications.

Descend to level 1

Level 1 / Rails upgrades

Every version is a station. I stop at each one.

An old Rails version is a risk: no security patches, gems that no longer install, and developers who do not want the job. I move your application to a supported version, one release at a time. The test suite is green at each station, and the application ships from each station.

  • Dual boot, so the old and the new version run from one branch
  • Deprecation warnings removed before each hop
  • Abandoned gems replaced or removed
  • Ruby upgraded together with Rails
  1. 4.2 Where many apps stopped
  2. 5.2 Active Storage, encrypted credentials
  3. 6.1 Zeitwerk, multiple databases
  4. 7.0 Hotwire, Active Record encryption
  5. 7.2 YJIT on by default
  6. 8.0 Solid Queue, Solid Cache, Kamal

Level 2 / Security audits

I read your code the way an attacker does.

Application security is my daily work. An audit is a manual review of your Rails application, with scanners as a second opinion, not the reverse.

You get a report that your developers can act on:

  • Each finding has a severity, a file, and a line
  • Each finding has a fix, not only a warning
  • A retest after your team applies the fixes

Security audit report

Client
redacted
Application
redacted (Rails)
Scope
Authn, authz, injection, secrets, PII, sessions, dependencies
IDSeverityFinding
RM-01 high Member route has no authorization check. A user can read the records of a different account (IDOR).
RM-02 high A scope builds SQL with string interpolation of a request parameter.
RM-03 medium Plaintext secrets in a committed .env file. The secrets stay in git history.
RM-04 medium Production logs contain personal data. The parameter filter does not cover the new fields.
RM-05 low Session cookie has a long lifetime and no rotation after login.

Specimen report. The findings are examples of what an audit covers. They are not client data.

Level 3 / Performance

Find the wide frame.
Remove it

An N+1 query, before and after one includes. An illustration, not a client result.
  1. N+1 queries
  2. Missing and unused indexes
  3. Slow PostgreSQL query plans
  4. Caching that is absent or wrong
  5. Work that belongs in a background job
  6. Memory growth

I measure first. Each change has a number before and a number after, from your production data.

Level 4 / New builds and MVP

From an empty directory to production.

Browser Rails 8 Hotwire tests + CI PostgreSQL Solid Queue ONE SERVER / KAMAL DEPLOY DWG MVP-01 DRAWN: AJI

rails new your_idea -d postgresql

create app/ config/ db/ test/

run bundle install

ok first deploy

Note 1
Rails, PostgreSQL, Hotwire. A boring stack on purpose.
Note 2
Tests and CI from the first commit.
Note 3
Authorization, input validation, and secrets management are in the first build, not in a later phase.
Note 4
The repository is yours from the first day.

Level 5 / How the work goes

Four shafts. No surprises.

  1. 1

    Survey

    I read the code, the logs, and the error tracker. You get a written assessment.

  2. 2

    Plan

    A fixed scope, ranked by risk and value. You approve the plan before work starts.

  3. 3

    Dig

    Small pull requests, with tests in each one. You see progress every week.

  4. 4

    Hand over

    Documentation and a walkthrough for your team. You keep everything.

Level 6 / Open source and side projects

The specimen cabinet

Things I dug out and left in the open.

More in the drawers: github.com/kuntoaji

About

To the owner of the application,

My name is Aji. I have written Ruby since 2009. Railsmine started that year as a blog about it.

My daily work is application security. I read code the way an attacker does, and I fix it the way a maintainer does.

You talk to the person who does the work. There is no account manager and no handover to a junior.

Aji

Railsmine, by KAK Labs

Level 8 / Contact

Last stop.

Tell me what the application does and where it hurts.

One way / Railsmine line FromYour backlog ToProduction kontak@kaklabs.com

Or copy the address: kontak@kaklabs.com