brakeman security audit about selfstarter

[skull-squadron]

Recommendations:

1. Specify a json version ~> 1.7.7. and/or ruby 1.9.3 in the Gemfile (at least on heroku, where 1.9.2's json is unpatched).
2. Redact the secret to an environment variable like RAILS_SESSION_SECRET.
3. Whatever. This might help: http://railscasts.com/episodes/358-brakeman?view=asciicast

[skull-squadron]

1. default ruby 1.9.2 on heroku

~ $ ruby -rjson -e 'JSON.parse '\''{"json_class":"JSON::GenericObject","foo":"bar"}'\'''
/usr/local/lib/ruby/1.9.1/json/common.rb:44:in `rescue in block in deep_const_get': can't find const JSON::GenericObject (ArgumentError)
    from /usr/local/lib/ruby/1.9.1/json/common.rb:41:in `block in deep_const_get'
    from /usr/local/lib/ruby/1.9.1/json/common.rb:36:in `each'
    from /usr/local/lib/ruby/1.9.1/json/common.rb:36:in `inject'
    from /usr/local/lib/ruby/1.9.1/json/common.rb:36:in `deep_const_get'
    from /usr/local/lib/ruby/1.9.1/json/common.rb:146:in `parse'
    from /usr/local/lib/ruby/1.9.1/json/common.rb:146:in `parse'
    from -e:1:in `<main>'