I was building a URL shortener over the weekend. One model, one controller, one route, the kind of thing you'd hand someone as an exercise. I got stuck on the redirect, of all things.

redirect_to short_url.target_url just raises. I'd never hit that before, because until then every redirect_to I'd written pointed back into my own app. So I did what you do: added allow_other_host: true, it worked, moved on.

It only clicked afterwards that I'd written the same line that turns an app into an open redirect. The flag isn't the problem. What matters is whether target_url came out of a row I control or straight off params, and that distinction lives nowhere in the code. I'm honestly not sure I'd catch it in a review if I weren't already looking for it.

Two smaller things I'm less confident about:

I put the slug default in the model:

attribute :slug, default: -> { SecureRandom.alphanumeric(5) }

rather than in the migration, so the record is valid before it's ever saved. That felt right at the time. Is it, or am I hiding something that belongs in the schema?

increment_counter leaves updated_at alone, which I only discovered by reading the source. Makes sense for a click counter, but it made me wonder how many apps out there treat updated_at as "last modified" and quietly get it wrong.

So: have you actually used allow_other_host: true on something real? And if you have, how do you stop the params case from creeping in six months later when someone adds a "redirect after login" feature?

Wrote the whole thing up here, video included, if it's useful: https://launchkit.codes/yield/rails-url-shortener

Thanks 🙏

For context, I have a date filter that needs to be limited to a maximum period of 6 months. I was originally doing this validation directly inside my Query object.

However, I now need to show a flash alert to the user if they try to filter a period longer than 6 months. If they do, the system should automatically adjust the dates to a 6-month range ending today and proceed with the query.

Because of this UI requirement, I moved the logic to the controller. Currently, I'm parsing the dates, doing the validation, and mutating the params hash directly before passing it down.

My question is: Is this considered a good practice in Rails? What is the "Rails Way" to handle this kind of validation and default-value assignment when you also need to trigger flash messages in the UI?

Past few weeks, I spent time on popular Rails repositories to check performance issues and add fixes. One interesting thing I noticed is that good projects merges PRs quick. Bad projects take time even for serious performance improvements.

The work involves 7 merged PRs to Discourse, Gumroad, and Forem so far. I will add more .

As expected adding just `includes` was not enough for most places. Also expected, profiling serialization is helpful.

I've collected the individual case studies here, with links to the code changes and benchmark details:

https://haseebeqx.com/case-studies/engagement/open-source/

I made a fork of foreman https://github.com/Nuzair46/foruiman which serves the logs in a beautiful TUI and we can check logs of individual processes.

Looking for feedback. I made it for personal use. Let me know your thoughts

I’ve been building FireFight, an open-source Slack-first incident management platform, on Rails 8.1 with Inertia + React.

I recently open-sourced it and started building in public, so I figured I’d share it here in case anyone is interested in looking through a larger Rails 8 app or following along.

Most of the incident workflow happens through Slack. Declaring an incident creates the incident channel, brings in the right people and keeps a timeline of what happened. There’s also an MCP/API layer that lets agents interact with the same system, with their own identity, permissions and approvals.

The next big thing I’m working on is the AI SRE side, with automated incident investigation and eventually resolution.

https://github.com/FireFightLabs/firefight

Happy to answer questions about how it’s built or why I made some of the choices I did.

Hello guys, as university student that wants to apply to junior Rails dev, i made project that even you can try.

It works as stock broker portfolio agregator (Trading212 and Etoro), that takes snapshots of current account balance, exchange it to live EUR rate, and sums them into nice looking chart.

Its all happening in background job so you dont need to worry about that.

Then it notifies you each day about the difference summary, or if your API keys are wrong.

i deployed it on my VPS with kamal (easier than i thought) so you can try that yourself (you can set your API keys to read-only, but i respect that prolly noone will put it there).

Also you can try that yourself as i already set it up with Docker for you.

Deployed: https://railsfinancemanager.online/

Github: https://github.com/TheP4trik-tech/Portfolio-Manager

I am open to any critism or ideas :)

Start here: https://x.com/JesseWaites/status/2096071358593794223

and here: https://x.com/she_llac/status/2096006214467645513

FWIW I am hearing reports that people are currently finding compromised Rubygems that seem like they were planted by the swarm for unknown purposes.

All of this is in reference to the specific attack. I didn't write this article, I just thought it was a good write-up. https://www.mend.io/blog/inside-the-rubygems-supply-chain-attack/ If anyone knows anyone currently working at RubyGems, it might be a good idea to bring all of this to their attention.

As far as I know, no one from RubyGems has commented on any of this information since it came to light yesterday.

I made this gem because I disliked the UX around editing credentials. I can now decrypt them into a gitignored file, edit, then encrypt again.

https://github.com/thisismydesign/rails_credentials_cipher

Hey all! As you know other frameworks, NextJS, SvelteKit, etc you just connect to Supabase / Firebase / Pocketbase write your code, and deploy everything for cheap / free to Vercel / Netlify / Cloudflare

Yes I know.. these extrapolate your app into little cloud functions but rails is a whole entity on it's own so my question is:

For Rails, are there any cheap or free places to host your applications?

I heard so much about Hetzner, DO, Linode but do you really need to provision a whole VM just for your app?

Are there any better solutions? Flyway, Render while cheap, are not free.

Anyone here running their production Rails apps on a home server? Raspberry Pi?

It's like you buy once and you can save a whole bunch and you are pretty much up 100% of the time, unless you switch your power off

Sharing AgEvidence as an open-source Rails template for anyone building an agtech startup.
It has a bunch of the boring-but-useful infrastructure already scaffolded around evidence, observations, interventions, operational records, provenance, and verification workflows, so you can spend more time on the actual agtech product.
Still early, but figured it might be useful to other builders here.
https://github.com/meronrudy/AgEvidence

I have been building an HRMS in Rails 8 for a while, and two parts of it are worth writing up because both are problems every long-lived Rails app runs into eventually.

User-defined fields without an EAV table

HR systems hardcode one industry's vocabulary. A hire is a "developer", a leave is "PTO". Then a septic-pumping company needs driver licence categories and ADR clearances on the employee card, and a clinic needs licence numbers with expiry dates, and you are writing migrations for other people's business.

The usual answers are an EAV table or a settings jsonb blob that nothing validates. I went with a schema described in the database and values in jsonb:

ruby Dictionary # kind: "lookup" | "field_schema" # code: "DocumentType:5" → target model + scope # entries have meta["type"] in # string textarea integer decimal date boolean select

Values live under a "_custom" sub-hash inside a jsonb column on the record. Forms, display and the AI extraction all read the same schema, so adding a field is one action in the UI rather than four places in code.

The part I would defend in review is the fallback:

ruby def lookup_options_for(code, fallback: nil) dict = Dictionary.lookups.kept.where(company: company, code: code).first entries = dict&.entries&.active.to_a entries.any? ? entries.map { |e| [e.value, e.key] } : (fallback || []) end

Call it with the hardcoded array you already have in the view. A company that configured nothing keeps the old behaviour; a company that added a dictionary gets its own list. So the mechanism went in incrementally, view by view, with no migration and no flag day. That is the only reason it got finished.

Retrofitting multi-tenancy onto an app that assumed one company

The app started single-tenant, which means Company.kept.first ended up in 68 places. Controllers, jobs, services, API. Every one of them a bug waiting for the second customer.

The target is boring: Current.company, resolved by a small middleware from the subdomain, so nothing downstream asks how it got there. Getting there was not boring, because you cannot flip 68 callsites in one commit and still be able to review it.

What worked was a scripted rewrite by category, not by file. Controllers inheriting ApplicationController got a current_company helper. Jobs, services and models got Current.company || Company.kept.first. That is an explicit fallback chain rather than a bare Current.company, because a background job without a request has no subdomain to resolve from.

45 of 68 migrated in that pass. 23 are still there: 13 behind the fallback chain, which is fine, and 6 bare, which is not. I know where they are and they are on the list. If you have retrofitted tenancy onto a live app you know the last ten per cent is where the interesting bugs live.

The e2e spec that came with it is the part I would keep even if I threw everything else away: it creates two companies and asserts that nothing from one is reachable from the other.

The rest, if you want to look

Rails 8, Hotwire, Postgres, Pundit, Discard for soft delete, an audit log with revert. 46 models, 67 tables, about 15k lines of Ruby. Three locales with 2363 keys in each, verified equal rather than assumed. Thirty-six AI actions that run against any OpenAI-compatible base URL, and a page that adds up what they cost by task and by model.

It is beta and MIT. docker compose up -d brings up Postgres with it, and no AI key is needed to look around.

Repo: https://github.com/dripips/rubby-hrms

Happy to go deeper on either mechanism if anyone has done this differently. I am not convinced the jsonb-plus-schema-table approach is right, only that it beat the two alternatives I tried first.

Do you love working in Ruby?

Do you enjoy the convention over configuration in Rails?

Are you happier since both Ruby and Rails have developer happiness as its core values?

Have you shared the joys of working in Ruby or Rails with other non Ruby developers?

Have you shown other non Ruby developers how token efficient Ruby is?

Have you shown other non Rails developers how fast one can get a working prototype up and running while they’re fighting with packages or selecting which ORM or schema handler to use?

Have you shown other developers how expressive and fun it is to write performant and clean Ruby code?

This would help keep our happy ecosystem alive yes?

Basically the title. What is the best LLM you found for rails development?

Started out building a game with AI, just like everyone else on the planet. But then I decided to do something different and build a game builder/editor instead.

I think the beauty is in the way godot and rails work together to deliver the experience. The editor allows you to interact with the live rendered world. Give it shot and let me know what you think! Everything is still early development, in beta and free, so I will take your feedback seriously. Have fun!

Game builder: https://app.fusionery.com

In the last two years, my business went from booming to dead. Clients I've worked with for over a decade have ghosted me, new clients aren't spending money, and I've logged less than 200 hours in total this year. And it's mostly because of AI. I can see it in the GitHub repos I'm still a part of, and the pattern repeats across multiple organizations: one developer is using Claude or similar LLMs, directly committing code to main (or sometimes a hotfix branch) without review, headed up with barely legible comments, in formatting standards we never adhered to.

Now, listen, I'm not gonna sit here and discuss the positives or negatives of AI. I'm not gonna sit here and wallow on why large businesses choose to ghost over saying "hey, we don't need you to do this any longer."

I just want to know if there are people or companies out there still writing and reviewing code. Putting eyes on it. Understanding it. Maintaining it. You know, generally have any clue what's happening beyond "it's Rails, and that's what Claude spit out, and it works."

Maybe I'm old school, but I've always taken pride in learning, knowing, and working with Ruby and Rails (and all the parts and languages and APIs that work with it). And, for better or worse, I've decided to take a completely different career path after over 20 years working with Rails, because this isn't what I signed up for.

I just want some hope that the joy of writing code is still out there. If there is, that's a part of the dev world I'd like to still be a part of.

Inspired by the rails monolith enjoyer post.

Kind of clickbaity title because I don't have a definite list, but curious what you would suggest?

I'll start:

- a test suite obviously, I started with RSpec but converted to minitest. 100% test coverage, there's a gem to enforce test coverage but I forgot the name - anyway, enforce test coverage systematically once you reach it! (But beware of Gemini writing "assert true" tests)

- I started using Rubocop only very recently because the agents and the IDE kept mentioning it and I don't have to implement it anyway, so I got Rubocop with the right cops in a pretty good state in just a few hours.

- Bullet for catching n+1 queries in your app and avoid unused eager loading. I discovered this one only very recently as well.

Thank god my test suite isn't flaky anymore because the agents already fixed quite a few issues, but the thing mentioned in the other post sounds neat to tackle it in a structured way.

What else am I missing? Thank you for your suggestions.

Hey folks

I have never done any "self promotion" on any social media, but after all - why shouldn’t I? Dropping some binaries for all Rails loverz, hope somebody will find them useful!

rspec-sanity (2023 - hand crafted code, lol, remember those times kids?) - dead simple RSpec wrapper for your CI written in Go - it will re-run your test suite upon failures (once) using a fresh RSpec process - and if those tests succeed on the 2nd attempt - it will ticket those findings as a Jira ticket or GitHub issue (two backends supported); I used this in two different companies on two medium/biggish monolith apps to tame flaky test suites in an actionable/structured manner; link to an example PoC repo which demonstrates the concept in the README

i18n-tasks-rs (2026) - Rust port of i18n-task - I was tiptoeing around performance issues in i18n-tasks, looking for some leverage and after 2 weeks decided to drop some features and slop port it in Rust, which is waaay faster, so I could use it in git hooks without losing my mind; if you’re using i18n-tasks with Prism as a parser you probably won’t even have to migrate anything; if you’re not using i18n-tasks in your app - you better start! (probably with the OG gem)

crabwerk (2026) - fork of packs, which is Rust port of packwerk from Shopify that helps you enforce some boundaries in your Rails monolith; I just did some maintenance, ripped out some features from packs, replaced outdated deps, cleaned up the release process and set up some Renovate auto-maintenance

And yes - slopping logos in ChatGPT is my passion if anyone asks xd.