rails-security-multitenancy

marckohlbrugge/37signals-skills · updated Jun 11, 2026

MDX-style export adds YAML metadata + attribution linking explainx.ai and this canonical listing URL.

$npx skills install marckohlbrugge/37signals-skills/rails-security-multitenancy
0 commentsdiscussion
summary

Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.

skill.md
name
rails-security-multitenancy
description
Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.
disable-model-invocation
true

Rails Security + Multi-Tenancy

Use for security-sensitive Rails work and tenant-boundary reviews. Patterns from Fizzy (path-based multi-tenant SaaS) and Campfire (single-tenant, bot APIs).

Core Rules

  • Scope all tenant data access through tenant/user ownership boundaries.
  • Never trust naked Model.find(params[:id]) in tenant-aware flows.
  • Scope realtime broadcasts and stream names by tenant/account.
  • Rate-limit auth and abuse-prone endpoints.
  • Treat user-provided URLs as untrusted input.
  • Fail closed (head :forbidden) when access cannot be proven.

Tenancy Architecture (path-based, Fizzy-style)

  • Middleware extracts the account prefix from PATH_INFO into SCRIPT_NAME, loads the account, and wraps the request in Current.with_account(account). URL helpers stay tenant-correct automatically (including ActiveStorage and webhook payload URLs via script_name:).
  • Three-layer auth: Identity → Session → account-scoped User. Sessions attach to an Identity; each request resolves Current.user = identity.users.find_by(account: Current.account). A valid session in account A can never act in account B. Apply the same resolution in ActionCable Connection#connect.
  • Current setters cascade: assigning session resolves identity, assigning identity resolves user for the current account.
  • Auth routes (login, signup, magic links) explicitly opt out of tenancy (disallow_account_scope) and redirect away from tenant-prefixed URLs.
  • Path-scope session cookies (path: account.slug) when simultaneous multi-tenant login is supported.
  • Recurring jobs run outside request context: iterate tenants explicitly (with_each_tenant). Serialize Current.account into job payloads (see rails-jobs).
  • Test the tenancy middleware in isolation with Rack::MockRequest; integration tests set default_url_options[:script_name] from the fixture account.

Scoped Lookups (defense in depth)

Params choose which record within an already-authorized set — never establish access:

@card = Current.user.accessible_cards.find_by!(number: params[:card_id])   # access graph
@membership = Current.user.memberships.find_by!(room_id: params[:room_id]) # join model
@user = Current.account.users.find(params[:user_id])                       # tenant association
  • Even single-tenant code scopes through associations; wrong IDs 404 naturally.
  • Public sharing uses opaque tokens (has_secure_token :key on a Publication record), never internal IDs.
  • ActiveStorage: attach blobs to accounts, and authorize blob/representation controllers through the domain (blob → attachment → record.accessible_to?(user)); published content gets an explicit publicly_accessible? path.
  • Revoking access cleans up derived data (mentions, notifications, watches) via a scoped async job — don't leave dangling cross-boundary state.

Authentication Hardening

  • Magic links / codes: single-use (consume destroys the row), short-lived, compared with secure_compare, bound to the email via a verified pending-auth cookie.
  • Anti-enumeration: unknown email gets the same fake flow/UX as a real one.
  • API tokens: HTTP-method-scoped permissions (read-only tokens can't POST); show generated secrets once via a short-lived message verifier (~10s), then never again.
  • Bot/automation auth as an explicit mode: skip CSRF only for bot-key auth, deny bots everywhere by default (deny_bots + allow_bot_access only:).
  • Rate limit with Rails built-ins, with responses matching endpoint semantics:
rate_limit to: 10, within: 15.minutes, only: :create,
  with: -> { redirect_to ..., alert: "Try again in 15 minutes." }
  • Throttle session bookkeeping writes (update last_active_at at most hourly).
  • Filter sensitive params beyond passwords: message bodies, push endpoints, tokens.

SSRF Defense Baseline

For webhooks, push endpoints, unfurling — any user-influenced URL:

  • Resolve DNS and validate the destination IP before the request; block loopback/private/link-local/IPv4-mapped-IPv6 ranges (link-local = cloud metadata).
  • Pin the request to the validated IP (Net::HTTP.new(host, port, ipaddr: resolved_ip)) to beat DNS rebinding.
  • Validate at creation time and again at execution time.
  • Re-resolve and re-validate on every redirect hop — redirect chains are the classic bypass.
  • Cap response sizes (content-length pre-check + chunked read limit) to prevent memory DoS.
  • Layer allowlists on top where the destination set is known (web push: permitted vendor host suffixes AND public-IP resolution).

CSRF and Caching

  • Never HTTP-cache pages that render forms/CSRF tokens.
  • Add Sec-Fetch-Site verification (same-origin/same-site) on top of origin checks; roll out in report-only mode first, and append Sec-Fetch-Site to the Vary header.
  • Set a CSP with a hard floor (object_src :none, base_uri :none, frame_ancestors :self); use report-only + report_uri to validate before enforcing.
  • Private apps: send X-Robots-Tag: none.

Authorization Defaults

  • Predicate methods on models (card.editable_by?(user), user.can_administer_board?(board)); controllers check and head :forbidden.
  • Declarative controller macros (allow_unauthenticated_access, ensure_can_administer) over scattered conditionals.
  • Centralize shared guard logic in small concerns.

Abuse Response

  • Banning a user cascades: convert their session IPs to bans, disconnect ActionCable remotely, delete sessions, purge content async with UI broadcasts.
  • Enforce IP bans only on mutating requests (POST/PUT/PATCH/DELETE).
  • Validate ban targets are public IPs — never let loopback/private ranges be banned.
  • Disconnect deactivated users: ActionCable.server.remote_connections.where(current_user: user).disconnect(reconnect: false).

Inbound Webhooks (receiving)

  • Verify signatures (e.g. Stripe::Webhook.construct_event), then re-fetch canonical state from the source API rather than trusting payload contents/ordering.

Red Flags

  • Tenant-unscoped broadcast channels or stream names.
  • Tenant data inferred from request params without ownership checks.
  • A global User looked up by session without account scoping (identity/user conflation).
  • Webhook or fetch requests to unvalidated destinations; redirects followed without re-validation.
  • ActiveStorage URLs that bypass domain authorization.
  • Security controls hidden in ad-hoc conditionals across controllers.
  • Secrets permanently visible in admin UIs.
  • Auth endpoints without rate limiting.
how to use rails-security-multitenancy

How to use rails-security-multitenancy on Cursor

AI-first code editor with Composer

1

Prerequisites

Before installing skills in Cursor, ensure your development environment meets these requirements:

  • Cursor installed and configured on your development machine
  • Node.js version 16.0+ with npm package manager (verify with node --version)
  • Active project directory or workspace where you want to add rails-security-multitenancy
2

Execute installation command

Execute the skills CLI command in your project's root directory to begin installation:

$npx skills install marckohlbrugge/37signals-skills/rails-security-multitenancy

The skills CLI fetches rails-security-multitenancy from GitHub repository marckohlbrugge/37signals-skills and configures it for Cursor.

3

Select Cursor when prompted

The CLI will show a list of available agents. Use arrow keys to navigate and space to select Cursor:

◆ Which agents do you want to install to?
│ ── Universal (.agents/skills) ── always included ────
│ • Amp
│ • Antigravity
│ • Cline
│ • Codex
│ ●Cursor(selected)
│ • Cursor
│ • Windsurf
4

Verify installation

Confirm successful installation by checking the skill directory location:

.cursor/skills/rails-security-multitenancy

Reload or restart Cursor to activate rails-security-multitenancy. Access the skill through slash commands (e.g., /rails-security-multitenancy) or your agent's skill management interface.

Security & Verification Notice

We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.

Skills execute code in your development environment. Always verify the publisher's identity, review recent commits, and test in isolated environments before production deployment.

List & Monetize Your Skill

Submit your Claude Code skill and start earning

GET_STARTED →

Use Cases

Task Automation & Efficiency

Automate repetitive workflows and reduce manual effort

Example

Generate reports, summarize documents, draft communications

Save 3-5 hours per week on routine tasks

Knowledge Enhancement

Learn new skills, understand complex topics, get expert guidance

Example

Explain concepts, provide examples, suggest learning resources

Accelerate learning and skill development by 2x

Quality Improvement

Enhance output quality through reviews, suggestions, and refinements

Example

Review drafts, suggest improvements, catch errors

Improve work quality by 30-40% with less effort

Implementation Guide

Prerequisites

  • Claude Desktop or compatible AI client with skill support
  • Clear understanding of task or problem to solve
  • Willingness to iterate and refine outputs

Time Estimate

15-45 minutes depending on use case complexity

Installation Steps

  1. 1.Install skill using provided installation command
  2. 2.Test with simple use case relevant to your work
  3. 3.Evaluate output quality and relevance
  4. 4.Iterate on prompts to improve results
  5. 5.Integrate into regular workflow if valuable

Common Pitfalls

  • Expecting perfect results without iteration
  • Not providing enough context in prompts
  • Using skill for tasks outside its intended scope
  • Accepting outputs without review and validation

Best Practices

✓ Do

  • +Start with clear, specific prompts
  • +Provide relevant context and constraints
  • +Review and refine all outputs before using
  • +Iterate to improve output quality
  • +Document successful prompt patterns

✗ Don't

  • Don't use without understanding skill limitations
  • Don't skip validation of outputs
  • Don't share sensitive information in prompts
  • Don't expect skill to replace human judgment

💡 Pro Tips

  • Be specific about desired format and style
  • Ask for multiple options to choose from
  • Request explanations to understand reasoning
  • Combine AI efficiency with human expertise

When to Use This

✓ Use When

Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.

✗ Avoid When

Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.

Learning Path

  1. 1Familiarize yourself with skill capabilities and limitations
  2. 2Start with low-risk, non-critical tasks
  3. 3Progress to more complex and valuable use cases
  4. 4Build expertise through regular use and experimentation

Discussion

Product Hunt–style comments (not star reviews)
  • No comments yet — start the thread.
general reviews

Ratings

4.751 reviews
  • Zaid Yang· Dec 28, 2024

    rails-security-multitenancy has been reliable in day-to-day use. Documentation quality is above average for community skills.

  • Tariq Flores· Dec 24, 2024

    Useful defaults in rails-security-multitenancy — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.

  • Zaid Chen· Dec 12, 2024

    rails-security-multitenancy is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.

  • Dhruvi Jain· Dec 8, 2024

    I recommend rails-security-multitenancy for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.

  • Amelia Srinivasan· Dec 8, 2024

    rails-security-multitenancy reduced setup friction for our internal harness; good balance of opinion and flexibility.

  • Oshnikdeep· Nov 27, 2024

    Solid pick for teams standardizing on skills: rails-security-multitenancy is focused, and the summary matches what you get after install.

  • Aanya Taylor· Nov 27, 2024

    rails-security-multitenancy has been reliable in day-to-day use. Documentation quality is above average for community skills.

  • Rahul Santra· Nov 19, 2024

    Useful defaults in rails-security-multitenancy — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.

  • Ira Bhatia· Nov 19, 2024

    rails-security-multitenancy reduced setup friction for our internal harness; good balance of opinion and flexibility.

  • Isabella Jain· Nov 7, 2024

    Registry listing for rails-security-multitenancy matched our evaluation — installs cleanly and behaves as described in the markdown.

showing 1-10 of 51

1 / 6