Rails: problem - who takes care of it - how

1) Input validation - programmer - validates_* and attr_accessible in the models

2) Output validation - programmer - HTML::Sanitize

3) SQL injection - rails - use ? or named_scope to construct complex queries

4) XSS - programmer - do not forget <%= h

5) Command injection - programmer - do not do it

6) Cleartext - programmer - requires_ssl module

7) CSRF - rails - uses authentication_token in all forms

8) Race conditions - rails - single threaded

9) Error info leaks - rails - use production mode

10) Memory - ruby - safe language

The rest are all on programmer - just do not do it.