rails-security-multitenancy▌
marckohlbrugge/37signals-skills · updated Jun 11, 2026
MDX-style export adds YAML metadata + attribution linking explainx.ai and this canonical listing URL.
Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.
| name | rails-security-multitenancy |
| description | Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints. |
| disable-model-invocation | true |
Rails Security + Multi-Tenancy
Use for security-sensitive Rails work and tenant-boundary reviews. Patterns from Fizzy (path-based multi-tenant SaaS) and Campfire (single-tenant, bot APIs).
Core Rules
- Scope all tenant data access through tenant/user ownership boundaries.
- Never trust naked
Model.find(params[:id])in tenant-aware flows. - Scope realtime broadcasts and stream names by tenant/account.
- Rate-limit auth and abuse-prone endpoints.
- Treat user-provided URLs as untrusted input.
- Fail closed (
head :forbidden) when access cannot be proven.
Tenancy Architecture (path-based, Fizzy-style)
- Middleware extracts the account prefix from
PATH_INFOintoSCRIPT_NAME, loads the account, and wraps the request inCurrent.with_account(account). URL helpers stay tenant-correct automatically (including ActiveStorage and webhook payload URLs viascript_name:). - Three-layer auth: Identity → Session → account-scoped User. Sessions attach to an
Identity; each request resolvesCurrent.user = identity.users.find_by(account: Current.account). A valid session in account A can never act in account B. Apply the same resolution in ActionCableConnection#connect. Currentsetters cascade: assigningsessionresolvesidentity, assigningidentityresolvesuserfor the current account.- Auth routes (login, signup, magic links) explicitly opt out of tenancy (
disallow_account_scope) and redirect away from tenant-prefixed URLs. - Path-scope session cookies (
path: account.slug) when simultaneous multi-tenant login is supported. - Recurring jobs run outside request context: iterate tenants explicitly (
with_each_tenant). SerializeCurrent.accountinto job payloads (see rails-jobs). - Test the tenancy middleware in isolation with
Rack::MockRequest; integration tests setdefault_url_options[:script_name]from the fixture account.
Scoped Lookups (defense in depth)
Params choose which record within an already-authorized set — never establish access:
@card = Current.user.accessible_cards.find_by!(number: params[:card_id]) # access graph
@membership = Current.user.memberships.find_by!(room_id: params[:room_id]) # join model
@user = Current.account.users.find(params[:user_id]) # tenant association
- Even single-tenant code scopes through associations; wrong IDs 404 naturally.
- Public sharing uses opaque tokens (
has_secure_token :keyon aPublicationrecord), never internal IDs. - ActiveStorage: attach blobs to accounts, and authorize blob/representation controllers through the domain (
blob → attachment → record.accessible_to?(user)); published content gets an explicitpublicly_accessible?path. - Revoking access cleans up derived data (mentions, notifications, watches) via a scoped async job — don't leave dangling cross-boundary state.
Authentication Hardening
- Magic links / codes: single-use (consume destroys the row), short-lived, compared with
secure_compare, bound to the email via a verified pending-auth cookie. - Anti-enumeration: unknown email gets the same fake flow/UX as a real one.
- API tokens: HTTP-method-scoped permissions (read-only tokens can't POST); show generated secrets once via a short-lived message verifier (~10s), then never again.
- Bot/automation auth as an explicit mode: skip CSRF only for bot-key auth, deny bots everywhere by default (
deny_bots+allow_bot_access only:). - Rate limit with Rails built-ins, with responses matching endpoint semantics:
rate_limit to: 10, within: 15.minutes, only: :create,
with: -> { redirect_to ..., alert: "Try again in 15 minutes." }
- Throttle session bookkeeping writes (update
last_active_atat most hourly). - Filter sensitive params beyond passwords: message bodies, push endpoints, tokens.
SSRF Defense Baseline
For webhooks, push endpoints, unfurling — any user-influenced URL:
- Resolve DNS and validate the destination IP before the request; block loopback/private/link-local/IPv4-mapped-IPv6 ranges (link-local = cloud metadata).
- Pin the request to the validated IP (
Net::HTTP.new(host, port, ipaddr: resolved_ip)) to beat DNS rebinding. - Validate at creation time and again at execution time.
- Re-resolve and re-validate on every redirect hop — redirect chains are the classic bypass.
- Cap response sizes (content-length pre-check + chunked read limit) to prevent memory DoS.
- Layer allowlists on top where the destination set is known (web push: permitted vendor host suffixes AND public-IP resolution).
CSRF and Caching
- Never HTTP-cache pages that render forms/CSRF tokens.
- Add
Sec-Fetch-Siteverification (same-origin/same-site) on top of origin checks; roll out in report-only mode first, and appendSec-Fetch-Siteto theVaryheader. - Set a CSP with a hard floor (
object_src :none,base_uri :none,frame_ancestors :self); use report-only +report_urito validate before enforcing. - Private apps: send
X-Robots-Tag: none.
Authorization Defaults
- Predicate methods on models (
card.editable_by?(user),user.can_administer_board?(board)); controllers check andhead :forbidden. - Declarative controller macros (
allow_unauthenticated_access,ensure_can_administer) over scattered conditionals. - Centralize shared guard logic in small concerns.
Abuse Response
- Banning a user cascades: convert their session IPs to bans, disconnect ActionCable remotely, delete sessions, purge content async with UI broadcasts.
- Enforce IP bans only on mutating requests (POST/PUT/PATCH/DELETE).
- Validate ban targets are public IPs — never let loopback/private ranges be banned.
- Disconnect deactivated users:
ActionCable.server.remote_connections.where(current_user: user).disconnect(reconnect: false).
Inbound Webhooks (receiving)
- Verify signatures (e.g.
Stripe::Webhook.construct_event), then re-fetch canonical state from the source API rather than trusting payload contents/ordering.
Red Flags
- Tenant-unscoped broadcast channels or stream names.
- Tenant data inferred from request params without ownership checks.
- A global
Userlooked up by session without account scoping (identity/user conflation). - Webhook or fetch requests to unvalidated destinations; redirects followed without re-validation.
- ActiveStorage URLs that bypass domain authorization.
- Security controls hidden in ad-hoc conditionals across controllers.
- Secrets permanently visible in admin UIs.
- Auth endpoints without rate limiting.
How to use rails-security-multitenancy on Cursor
AI-first code editor with Composer
Prerequisites
Before installing skills in Cursor, ensure your development environment meets these requirements:
- ›Cursor installed and configured on your development machine
- ›Node.js version 16.0+ with npm package manager (verify with
node --version) - ›Active project directory or workspace where you want to add rails-security-multitenancy
Execute installation command
Execute the skills CLI command in your project's root directory to begin installation:
The skills CLI fetches rails-security-multitenancy from GitHub repository marckohlbrugge/37signals-skills and configures it for Cursor.
Select Cursor when prompted
The CLI will show a list of available agents. Use arrow keys to navigate and space to select Cursor:
Verify installation
Confirm successful installation by checking the skill directory location:
Reload or restart Cursor to activate rails-security-multitenancy. Access the skill through slash commands (e.g., /rails-security-multitenancy) or your agent's skill management interface.
Security & Verification Notice
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your development environment. Always verify the publisher's identity, review recent commits, and test in isolated environments before production deployment.
List & Monetize Your Skill
Submit your Claude Code skill and start earning
Use Cases▌
Task Automation & Efficiency
Automate repetitive workflows and reduce manual effort
Example
Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Knowledge Enhancement
Learn new skills, understand complex topics, get expert guidance
Example
Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Quality Improvement
Enhance output quality through reviews, suggestions, and refinements
Example
Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Implementation Guide▌
Prerequisites
- ›Claude Desktop or compatible AI client with skill support
- ›Clear understanding of task or problem to solve
- ›Willingness to iterate and refine outputs
Time Estimate
15-45 minutes depending on use case complexity
Installation Steps
- 1.Install skill using provided installation command
- 2.Test with simple use case relevant to your work
- 3.Evaluate output quality and relevance
- 4.Iterate on prompts to improve results
- 5.Integrate into regular workflow if valuable
Common Pitfalls
- ⚠Expecting perfect results without iteration
- ⚠Not providing enough context in prompts
- ⚠Using skill for tasks outside its intended scope
- ⚠Accepting outputs without review and validation
Best Practices▌
✓ Do
- +Start with clear, specific prompts
- +Provide relevant context and constraints
- +Review and refine all outputs before using
- +Iterate to improve output quality
- +Document successful prompt patterns
✗ Don't
- −Don't use without understanding skill limitations
- −Don't skip validation of outputs
- −Don't share sensitive information in prompts
- −Don't expect skill to replace human judgment
💡 Pro Tips
- ★Be specific about desired format and style
- ★Ask for multiple options to choose from
- ★Request explanations to understand reasoning
- ★Combine AI efficiency with human expertise
When to Use This▌
✓ Use When
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid When
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
Learning Path▌
- 1Familiarize yourself with skill capabilities and limitations
- 2Start with low-risk, non-critical tasks
- 3Progress to more complex and valuable use cases
- 4Build expertise through regular use and experimentation
Discussion
Product Hunt–style comments (not star reviews)- No comments yet — start the thread.
Ratings
4.7★★★★★51 reviews- ★★★★★Zaid Yang· Dec 28, 2024
rails-security-multitenancy has been reliable in day-to-day use. Documentation quality is above average for community skills.
- ★★★★★Tariq Flores· Dec 24, 2024
Useful defaults in rails-security-multitenancy — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
- ★★★★★Zaid Chen· Dec 12, 2024
rails-security-multitenancy is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
- ★★★★★Dhruvi Jain· Dec 8, 2024
I recommend rails-security-multitenancy for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
- ★★★★★Amelia Srinivasan· Dec 8, 2024
rails-security-multitenancy reduced setup friction for our internal harness; good balance of opinion and flexibility.
- ★★★★★Oshnikdeep· Nov 27, 2024
Solid pick for teams standardizing on skills: rails-security-multitenancy is focused, and the summary matches what you get after install.
- ★★★★★Aanya Taylor· Nov 27, 2024
rails-security-multitenancy has been reliable in day-to-day use. Documentation quality is above average for community skills.
- ★★★★★Rahul Santra· Nov 19, 2024
Useful defaults in rails-security-multitenancy — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
- ★★★★★Ira Bhatia· Nov 19, 2024
rails-security-multitenancy reduced setup friction for our internal harness; good balance of opinion and flexibility.
- ★★★★★Isabella Jain· Nov 7, 2024
Registry listing for rails-security-multitenancy matched our evaluation — installs cleanly and behaves as described in the markdown.
showing 1-10 of 51