All fixes

Turn off the Rails route listing page

tech-rails-routes

The Rails route listing page is serving, which only happens in development mode, and it reveals every controller and path. Set RAILS_ENV properly.

Why this matters

Rails route listing is exposed (development mode). It reveals endpoints and controllers — reconnaissance data, not directly exploitable.

Rails

  1. 1 Ensure RAILS_ENV is set to production. Route listing is only enabled in development mode.
  2. 2 If this is a staging environment, restrict access at the web server level
bash 
# Set environment variable
export RAILS_ENV=production

# Verify in Rails console
Rails.env.production? # should be true
Rails docs

Does your app still have this?

Scan your domain