I personally have been turned off from it. Not that they have security issues, everyone does, it's the time required to roll out changes basically requires not just updating a library, but updating your framework since the line between your code and the framework can be extremely blurred.

This means that if you have multiple rails sites with limited or no timely dev support you may not be readily able to upgrade your site to resolve issues.

This is why I took down my personal blog I had built in rails since I didn't want to be exposed to these issues and didn't have the time or desire to uplift the site onto more recent versions of rails.

I would absolutely use Rails for new projects, specifically because these issues are being surfaced and fixed.

A framework or system with only 10 users will never have the depth of security and bug fixing coverage that a larger, well used system has.

Given the local root in Linux lately (CVE-2013-2094), would you still recommend Linux for a server OS? :P

I wouldn't.

I'd go with something with a definitive support life and paid support if you need it.

Either that or something simple enough you can run your own fork.

As a Drupal dev, I couldn't recommend any CMS if we go by that standard. None of them are secure forever. A security policy is what makes a CMS trustworthy, as there will always be holes.

As a guy who dislikes it (and doesn't know all that much about it), I still find Rails' security policy to be efficient and reasonable.

I don't write web software, but I can't imagine that any other framework of any kind that approaches Rails' feature breadth or popularity isn't as ridden with subtle security flaws, to say nothing of terrible, forehead-slapping boners.