---
title: "Ruby on Rails Security Maintenance"
description: "We keep your Ruby on Rails application patched - Ruby, Rails, gems, JavaScript packages and the system underneath - and react quickly to security advisories."
url: "https://qameta.com/ruby-on-rails-security-maintenance/"
---

# Ruby on Rails Security Maintenance

Most security incidents in web applications don't need a clever attacker. They
need a known vulnerability in a dependency that nobody got around to updating.
Security maintenance is about closing those gaps continuously, before they
become a problem.

## What can go wrong

* Ruby and Rails versions that no longer receive security patches
* Gems with published vulnerabilities that stay in the `Gemfile.lock` for months
* Outdated JavaScript packages, base images and system libraries
* Security advisories that land in someone's inbox and are never acted on
* Updates postponed because nobody is sure what they might break

## What we do

* **Monitor advisories.** We follow security advisories for Ruby, Rails, your
  gems and JavaScript packages, and check which ones actually affect your
  application.
* **Patch quickly.** Critical fixes are prepared and shipped fast, routine
  updates on a regular schedule.
* **Automate the routine.** Dependency scanning with tools like `bundler-audit`
  and Brakeman runs in your
  [Continuous Integration](https://qameta.com/continuous-integration/) pipeline, so new issues are
  found on every change.
* **Keep versions supported.** We keep Ruby and Rails on supported versions
  through [step-by-step upgrades](https://qameta.com/ruby-on-rails-upgrades/), so security patches
  keep coming.
* **Update safely.** Every update goes through your test suite and your
  [Continuous Delivery](https://qameta.com/continuous-delivery/) pipeline - which is why we care
  about [Test Driven Development](https://qameta.com/test-driven-development/).
* **Look beyond the app.** Base images, operating system packages, TLS
  configuration and secrets handling are part of the picture too.

## Summary

Security maintenance is not a one-off project, it is a habit. We take care of
it for you, so known vulnerabilities get fixed in days, not months. It is also
a core part of our [maintenance retainer](https://qameta.com/ruby-on-rails-maintenance-retainer/),
and if you need a deeper look at your security posture, we offer
[security audits](https://qameta.com/security-audits-iso-27001/) as well.

Want your Rails application kept patched and secure? [Get in touch](mailto:info@qameta.com).