Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add marckohlbrugge/37signals-skills/rails-security-multitenancyCompatible with
Supported agents
| name | rails-security-multitenancy |
| description | Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints. |
| disable-model-invocation | true |
Use for security-sensitive Rails work and tenant-boundary reviews. Patterns from Fizzy (path-based multi-tenant SaaS) and Campfire (single-tenant, bot APIs).
Model.find(params[:id]) in tenant-aware flows.head :forbidden) when access cannot be proven.PATH_INFO into SCRIPT_NAME, loads the account, and wraps the request in Current.with_account(account). URL helpers stay tenant-correct automatically (including ActiveStorage and webhook payload URLs via script_name:).Identity; each request resolves Current.user = identity.users.find_by(account: Current.account). A valid session in account A can never act in account B. Apply the same resolution in ActionCable Connection#connect.Current setters cascade: assigning session resolves identity, assigning identity resolves user for the current account.disallow_account_scope) and redirect away from tenant-prefixed URLs.path: account.slug) when simultaneous multi-tenant login is supported.with_each_tenant). Serialize Current.account into job payloads (see rails-jobs).Rack::MockRequest; integration tests set default_url_options[:script_name] from the fixture account.Params choose which record within an already-authorized set — never establish access:
@card = Current.user.accessible_cards.find_by!(number: params[:card_id]) # access graph
@membership = Current.user.memberships.find_by!(room_id: params[:room_id]) # join model
@user = Current.account.users.find(params[:user_id]) # tenant association
has_secure_token :key on a Publication record), never internal IDs.blob → attachment → record.accessible_to?(user)); published content gets an explicit publicly_accessible? path.secure_compare, bound to the email via a verified pending-auth cookie.deny_bots + allow_bot_access only:).rate_limit to: 10, within: 15.minutes, only: :create,
with: -> { redirect_to ..., alert: "Try again in 15 minutes." }
last_active_at at most hourly).For webhooks, push endpoints, unfurling — any user-influenced URL:
Net::HTTP.new(host, port, ipaddr: resolved_ip)) to beat DNS rebinding.Sec-Fetch-Site verification (same-origin/same-site) on top of origin checks; roll out in report-only mode first, and append Sec-Fetch-Site to the Vary header.object_src :none, base_uri :none, frame_ancestors :self); use report-only + report_uri to validate before enforcing.X-Robots-Tag: none.card.editable_by?(user), user.can_administer_board?(board)); controllers check and head :forbidden.allow_unauthenticated_access, ensure_can_administer) over scattered conditionals.ActionCable.server.remote_connections.where(current_user: user).disconnect(reconnect: false).Stripe::Webhook.construct_event), then re-fetch canonical state from the source API rather than trusting payload contents/ordering.User looked up by session without account scoping (identity/user conflation).AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionrails-security-multitenancyExecute the skills CLI command in your project's root directory to begin installation:
epx add marckohlbrugge/37signals-skills/rails-security-multitenancyFetches rails-security-multitenancy from marckohlbrugge/37signals-skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/rails-security-multitenancy
Restart Cursor to activate rails-security-multitenancy. Access via /rails-security-multitenancyin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
dhh
marckohlbrugge/37signals-skills · dhh · same repo
rails-best-practices-core
marckohlbrugge/37signals-skills · rails-best-practices-core · same repo
rails-migrations
marckohlbrugge/37signals-skills · rails-migrations · same repo
rails-jobs
marckohlbrugge/37signals-skills · rails-jobs · same repo
rails-webhooks
marckohlbrugge/37signals-skills · rails-webhooks · same repo
rails-testing
marckohlbrugge/37signals-skills · rails-testing · same repo
rails-security-multitenancy has been reliable in day-to-day use. Documentation quality is above average for community skills.
Useful defaults in rails-security-multitenancy — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
rails-security-multitenancy is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
I recommend rails-security-multitenancy for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
rails-security-multitenancy reduced setup friction for our internal harness; good balance of opinion and flexibility.
Solid pick for teams standardizing on skills: rails-security-multitenancy is focused, and the summary matches what you get after install.
rails-security-multitenancy has been reliable in day-to-day use. Documentation quality is above average for community skills.
Useful defaults in rails-security-multitenancy — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
rails-security-multitenancy reduced setup friction for our internal harness; good balance of opinion and flexibility.
Registry listing for rails-security-multitenancy matched our evaluation — installs cleanly and behaves as described in the markdown.
showing 1-10 of 51