FYI you can get Rails security alerts directly to your inbox via http://groups.google.com/group/rubyonrails-security