Hi, the *official* Rails security list is at http://groups.google.com/group/rubyonrails-security now.