I&#x27;ve seen a bunch of companies use rails HTTP basic auth internally.<p>And it&#x27;s not that it wasn&#x27;t caught until now, it&#x27;s that it wasn&#x27;t caught before the commit was accepted.