The Security Work That's Actually on You
Rails handles framework-level security defaults — but authorization, rate limiting, CSP, session hardening, and encrypted attributes are decisions only you can make.
I'm Mario Alberto, a software engineer and entrepreneur based in Colima, México. I'm the creator of Rails MCP Server and former CTO/co-founder of Aoorora, where I architected a core banking platform in Ruby on Rails that enabled lending startups to build on modern, secure infrastructure. I spend my time at the intersection of Ruby on Rails and AI—building tools that help developers work smarter. When I'm not writing code, I'm documenting territory, popular culture, and memory through photography.
Rails handles framework-level security defaults — but authorization, rate limiting, CSP, session hardening, and encrypted attributes are decisions only you can make.
Rails security defaults cover CSRF, SQL injection, XSS, encrypted sessions, and more — here's what the framework handles before you write business logic.
The tools and workflow I use to ship Rails MVPs with Claude — from market research to spec-driven development — shared at the Claude Colima meetup.