The official Ruby on Rails security guide

You’ll find the latest version of the guide here. The legacy versions are also available: Rails 2.3.11, 3.2.21, 4.0.12and4.1.8.