The reality is that bad actors scan the pubic Internet for exploitable servers all the time. It's easy, it's cheap, and it's a very effective way to grow your botnet. If you're on the Internet, it doesn't matter how obscure you are: someone will eventually probe you.
> I think we have to warm all RoR developers...
Every time I touch a new project it's in need of security updates. Any time a site gets owned, there's no accountability or logging or anything. Any time a security issue does manage to get found it's as if it's a rare new thing. "Wow, who would have thought that could happen." Well, let's see, the developers of the software you're using, and anyone that pays attention to them.
Also http://getshrubbery.com/home which is free, but seemed mildly broken when I tried it (it seemed to forget some of my actually outdated packages when I tried it).
http://www.kalzumeus.com/2013/01/31/what-the-rails-security-...
Regardless, it's an absolute must read for anyone even thinking about using rails.