but now Ruby on Rails is not a circus like how Next.js is.

see [0]: Rails security Audit Report

[0]: https://ostif.org/ruby-on-rails-audit-complete/