Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a fuller Rails app and take it toward production (a multi-user SaaS-style app, a marketplace). Requirements: (1) authentication (a starter kit or Devise) plus AUTHORIZATION with Pundit/CanCanCan policies; (2) OFFLOAD slow work to Active Job (perform_later) with a real adapter (Sidekiq or Solid Queue) — e.g. email via deliver_later; (3) SECURITY: rely on Rails' defaults — CSRF token, ERB auto-escaping, parameterized Active Record (no string-interpolated SQL), strong parameters — and manage secrets via ENCRYPTED CREDENTIALS (credentials.yml.enc + RAILS_MASTER_KEY kept out of git); run Brakeman and fix findings; (4) a solid test suite (model + system tests, a rolled-back test DB); (5) a deployment story — Puma, assets:precompile, migrations on deploy, and Kamal (Docker) or an equivalent, with the queue worker running. Document the security and deploy choices.
Authentication + Pundit/CanCanCan authorization; slow work offloaded to Active Job with a real adapter (Sidekiq/Solid Queue).
Rails defaults relied on (CSRF/auto-escaping/parameterized AR/strong params); secrets in encrypted credentials (out of git); Brakeman run and clean.
Model + system tests on a rolled-back test DB; a credible deploy story — Puma, assets:precompile, migrations on deploy, Kamal/Docker + a queue worker.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A production-ready, secure Rails app ## Goal Build a fuller Rails app and take it toward production (a multi-user SaaS-style app, a marketplace). Requirements: (1) authentication (a starter kit or Devise) plus AUTHORIZATION with Pundit/CanCanCan policies; (2) OFFLOAD slow work to Active Job (perform_later) with a real adapter (Sidekiq or Solid Queue) — e.g. email via deliver_later; (3) SECURITY: rely on Rails' defaults — CSRF token, ERB auto-escaping, parameterized Active Record (no string-interpolated SQL), strong parameters — and manage secrets via ENCRYPTED CREDENTIALS (credentials.yml.enc + RAILS_MASTER_KEY kept out of git); run Brakeman and fix findings; (4) a solid test suite (model + system tests, a rolled-back test DB); (5) a deployment story — Puma, assets:precompile, migrations on deploy, and Kamal (Docker) or an equivalent, with the queue worker running. Document the security and deploy choices. ## Acceptance criteria - [ ] Feature depth: Authentication + Pundit/CanCanCan authorization; slow work offloaded to Active Job with a real adapter (Sidekiq/Solid Queue). - [ ] Security hardening: Rails defaults relied on (CSRF/auto-escaping/parameterized AR/strong params); secrets in encrypted credentials (out of git); Brakeman run and clean. - [ ] Tests & deployment: Model + system tests on a rolled-back test DB; a credible deploy story — Puma, assets:precompile, migrations on deploy, Kamal/Docker + a queue worker. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.