Thousands of Ruby on Rails sites leave logins lying around

I am not remotely qualified to judge this, alas. Can someone please indicate how valid this is?

Classic Rails.