Not only did this person make several large and irresponsible mistakes in the process of uncovering and reporting the bug (dumping tons of private user information without permission, going far beyond simply discovering and reporting the bug, etc.), but they also keep referring to Ruby (&quot;running Ruby 3.x, which is susceptible to code execution via the Ruby session cookie&quot;) as the vulnerable piece, when in reality, it&#x27;s the version of <i>Rails</i> that had the vulnerability.