This has been discussed since the early days of Rails, and they have chosen to l...

		cdcarter on March 4, 2012 \| parent \| context \| favorite \| on: Hacked: commit to rails master on GitHub This has been discussed since the early days of Rails, and they have chosen to leave their defaults as such and encourage developers to implement model security as needed. Github (seemingly) did not implement model security. This is a vulnerability that is different from application to application, and if the team was following best practices, is not there.

And he's just demonstrated why this is not a responsible approach from the Rails team.