XSS,CSRF,SQLi – we don't have any of those in Rails at all

I know the tweet is caustic but it did spark a good discussion.