High severityRubyInsecure ConfigurationHIGH confidence

Consider All Requests Local

consider_all_requests_local = true makes Rails render full exception pages with backtraces to every client (CWE-1188/CWE-209).

Standards mapping

CWE: CWE-1188: Insecure Default Initialization of Resource CWE-209: Generation of Error Message Containing Sensitive Information
OWASP Top 10: A05:2021 - Security Misconfiguration
OWASP ASVS: V14.3.2 (L1)

Vulnerable vs. safe

Flagged by this check

config.consider_all_requests_local = true

Passes - the safe pattern

config.consider_all_requests_local = false

Why it matters & how to fix it

consider_all_requests_local = true makes Rails render full exception pages with backtraces to every client (CWE-1188/CWE-209). Keep this false in production so detailed errors are only shown locally and users see the generic error page.

References

Rule ID integsec-ruby-consider-all-requests-local - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks