{
  "id": 1817444,
  "title": "I Could Hack My Own Rails App With One Hidden Input",
  "url": "https://urgent.news/2026/08/18/i-could-hack-my-own-rails-app-with-one-hidden-input",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-18T22:07:47.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gjhewitt/i-could-hack-my-own-rails-app-with-one-hidden-input-3ca1"
  },
  "original_language": "en",
  "account": "RepBoard is a Rails app designed for freelancers to showcase their reputation. The author had assumed the app was reasonably secure until they conducted a security audit on it. They discovered four vulnerabilities in the app. Firstly, the app had two types of users, freelancers and clients, determined by a boolean column in the users table. The developer had permitted the 'reviewable' parameter in the app's controller, allowing users to change their reviewable status. By adding a value of '1' to this parameter in the account settings form, a client could convert their account to a freelancer, gaining access to a public profile for collecting reviews. The fix was removing the 'reviewable' parameter from the permit list. Secondly, the app checked that a user was a client before creating a review, but it did not verify that the recipient was a freelancer. This allowed a client to leave a review for another client or even themselves. The validation for this check should have been implemented in the model, as it is a data rule rather than a permission rule. Thirdly, the seed data the app generated during setup treated all users as freelancers, creating a scenario where freelancers were reviewing each other. This issue arose because the validations had not been applied to the seed data. Lastly, the app had disabled CSRF protection in the initializers file, which could have allowed a malicious page to change a logged-in user's account type without their consent. The author learned the importance of thoroughly reviewing the application's configuration files and security settings from the start, as many security defaults are chosen by experts and may not align with individual project needs.",
  "summary": "I've been building RepBoard , a Rails app that gives freelancers a portable reputation profile — collect reviews from clients, share one professional link. It's deployed. It has accounts on it. Until this week I would have told you it was reasonably secure. Then I read two tutorials about locking down a different app, and instead of just following along, I ran the same audit on my own code. To my…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}