There’s still the issue of retooling: at what point does it make sense to reimplement your app on top of a template that uses stuff that didn’t exist when you started. So how do we retroactively beef up the security of some Rails app that’s 18+ months old? Maybe your argument about it belonging in the framework holds water after all. :)

Actually, Rails really needs better secure-by-default configuration. Stuff like attr_accessible is a step in the right direction, but … considering Rails is already a heavy full-stack framework, I’d make a standard auth mechanism part of the stack unless the developer specifically disables it. Having a standard baked in user/role/access system would make it easy-ish to have the meta-programming-based code (e.g. joins) perform checks on all data access, etc.

I’d even go so far as to make the production config automatically use https for urls, and add a utility to generate and handle certs for testing.