Hacker News Reader

I thought most of the security in Rails is provided by the rack-security middleware? Or am I forgetting something which Rails provides here?

Escaping everything by default to avoid XSS attacks. that's a nice feature to have.