[tptacek]

I don't think I would take things so far as to say that the Rails project has been a model for how to handle security problems.

[knowtheory]

Yep, sorry if I gave that impression.

All I mean to say is that the implication that the Rails community has been particularly lax over security issues is simply false.

Is there room for improvement? Yeah, probably so.