Modern Web application frameworks offer a vast amount of ways to introduce security vulnerabilities. In this talk we'll have an overview of common and not so common patterns of vulnerabilities. The main focus will be Ruby on Rails applications, but also generic patterns which apply to other languages and frameworks will be elaborated. Instead of just showing off with 1337 bugs and exploits, mitigation strategies will also be provided.