> Like many projects, Rails is continually discovering potential security problems, though I wouldn't say it is significantly worse than other comparable frameworks/stacks

Compared to Django, a framework similar both in feature and popularity, Rails is definitely worse. Especially compared with the most serious flaws (code execution, SQL injections).

http://www.cvedetails.com/product/18211/Djangoproject-Django... http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-...

Not sure about the JSON incident you mention. Maybe you thought about YAML?