Developer Finds Four Security Flaws in His Own Live Rails App During Routine Audit

A developer building RepBoard, a freelancer reputation platform, discovered four security vulnerabilities in his own deployed app after applying an audit process he learned from unrelated tutorials. The most critical flaw allowed any logged-in client to secretly add a hidden input field in the account settings form and grant themselves freelancer status, exploiting an overly permissive Devise parameter list. A separate vulnerability let clients submit reviews targeting other clients or even themselves, since the recipient's ID was pulled from an unvalidated hidden form field. The developer fixed the role-escalation bug by removing the sensitive parameter from the permitted list, and addressed the review flaw by moving authorization logic into model-level validations. The incident highlighted the distinction between validation and authorization, and revealed that his seed data had been silently generating invalid records all along.