The biggest issue we have seen in client projects, where they have an existing Rails project is not just the numerous holes in the core framework, but that they used many, many gems, the majority of which end us as abandonware, and are often chock-full of poor code, security blunders and generally bad design, that leaves the site wide open.

We have been able to successfully migrate a number of clients onto alternative lighter frameworks, or in some cases lean stacks, given they received a massively over engineered rails project for what was really a CMS requirement.

I really hope one day to stumble onto a well written, well maintained and we'll designed Rails app, but have not seen one yet...