XSS,CSRF,SQLi – we don't have any of those in Rails at all (twitter.com)

I know the tweet is caustic but it did spark a good discussion.