Comment by _jss

As a counter-point (and I know nothing about Gitlab), but GitHub and Shopify are both prominent Rails apps with pretty good security records. GitHub wrote about it last year: https://github.blog/engineering/architecture-optimization/bu...

I think the answer to your question is the same as any large application: pay attention to your supply chain, architect your systems well, if you don’t know how to do things securely go learn before building (or learn as you go, but that has consequences typically).