Security
Every Omaship project ships with production-grade security.
No security expertise required. No shortcuts to regret.
AI coding agents can build features fast—but they don't think about security by default. They won't add rate limiting, configure CSP headers, or set up dependency auditing unless you ask.
Most vibe-coded projects launch with zero security configuration. That's fine for a weekend hack. It's a liability for a product handling real user data—and a dealbreaker during due diligence.
Every Omaship project ships with these security measures—configured and active from the first deploy.
Brakeman scans your codebase on every CI run for SQL injection, XSS, mass assignment, and 30+ vulnerability types. Issues block the build before they reach production.
bundler-audit checks every gem against the Ruby Advisory Database. Known vulnerabilities in your dependencies are flagged before deploy. Dependabot opens PRs for outdated packages automatically.
Rack::Attack throttles abusive requests out of the box. Login endpoints are protected against brute-force attacks. API rate limits prevent abuse.
Content Security Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security—all configured with sensible defaults. SSL via Let's Encrypt auto-renews through Kamal.
Every admin action is logged with user, IP address, and change diff. Failed login attempts are tracked with reason codes. Full audit trail for compliance and debugging.
Honestly: most solo founders skip all of this. Here's what ships by default.
| Security measure | Omaship | Typical vibe-coded app | DIY (manual setup) |
|---|---|---|---|
| Static security scanning | ✓ Every CI run | ✗ | ~ Hours to set up |
| Dependency auditing | ✓ + Dependabot | ✗ | ~ Easy to forget |
| Rate limiting | ✓ Rack::Attack | ✗ | ~ Often skipped |
| CSP headers | ✓ Configured | ✗ | ~ Complex |
| SSL / HTTPS | ✓ Auto-renew | ~ Platform-dependent | ~ Manual cert setup |
| Audit logging | ✓ Built-in | ✗ | ~ Days to build |
When a buyer does due diligence, security is the first thing they check. Here's what they'll find:
✓ What buyers see
✗ What they find in vibe-coded apps
We use analytics and session recordings to learn which parts of Omaship help and which need work. Accept all, or customize what you share.