If your app has been running for over a year, you might want to look into this (before someone else does)... http://groups.google.com/group/rubyonrails-security/msg/7f57...