For whose wondering, brief read of the paper&#x27;s initial chapters show that it&#x27;s a methodology (and toolset) to find access control issues in RoR. Seems like a smart approach, need to see it in production though. I&#x27;m not really surprised if they found various ACL related vulnerabilities with this model in web apps, it&#x27;s a common issue and not easy to test &amp; check.<p>Injection vulnerabilities (XSS, SQLI etc.) are out of the scope of this document&#x2F;toolset, it&#x27;s heavily designed for detect ACL issues in web applications.