Understanding that most security issues in Ruby web applications are high level

For applications written in C, most security issues tend to be low-level security issues. These security issues are caused by things such as buffer overflows, integer overflows or underflows, and use-after-free (UAF) vulnerabilities. Ruby itself is mostly written in C, so a bug in Ruby itself could result in one of the previous security issues affecting Ruby. In addition, some Ruby gems include C extensions, either for performance reasons and/or because they need to interface with other libraries written in C. Ruby gems that include C extensions can also experience all these security issues.

Because of how many people use Ruby, low-level vulnerabilities in Ruby itself, while not impossible, are less likely. However, Ruby gems that include C extensions do not generally receive the same level of scrutiny as Ruby itself, so you should be careful when using gems that include C extensions. Really, it helps...