Web Application Security Best Practices: A Backdoor Case
Ramona Rohan
Head of Quality Assurance
Reading time: 3 min
Updated: Jul 2, 2026
Key takeaways
- Web application security is an ongoing practice, not a one-off audit.
- The 2019 rest-client Ruby gem backdoor leaked credentials from apps using versions 1.6.10 to 1.6.13.
- Wolfpack Digital scanned every project in under two hours and confirmed all ran safe versions.
- The OWASP Top 10 for 2025 lists Software Supply Chain Failures as a new critical risk category.
- Core best practices: test often, use multi-factor authentication, audit dependencies, monitor the supply chain, and keep an incident plan.
At Wolfpack Digital, web application security is a year-round habit, not a once-a-year checklist. Every dependency we ship is a potential door into an app. So when a backdoor turns up in a popular open-source library, we act fast.
This is the story of how we handled one such case, and the web application security best practices that kept our clients safe. It is a useful playbook for any team that builds software.
What happened: a backdoor in a Ruby gem
Back in August 2019, security researchers found a backdoor in a widely used Ruby gem. The affected package was the popular rest-client gem, downloaded more than 100 million times. Attackers had slipped malicious code into versions 1.6.10 through 1.6.13. The code sent data from apps to external servers.
One of the maintainers explained the risk in plain terms:
The data most exposed to this leak is login credentials, used to access databases, payment systems, and other platforms.
Stolen credentials can unlock databases and payment systems, so the stakes were high. We build apps with Ruby on Rails, so this news landed close to home. We also cover the basics of secure Rails apps in a separate guide.
How we responded: web application security best practices in action
In under two hours, the whole team knew about the issue. Our Head of Web Development shared clear, quick steps to protect every project we run.
Our engineers ran an X-ray check on all the web apps in our portfolio. The goal was simple: find every project that used the affected gem.
We need to search all our codebases for Gemfile.lock files that pin one of the malicious versions. If we spot an anomaly, we update to a safe version and ship an immediate release.
The results of our security audit were reassuring. Every project already ran a safe version, so none were exposed. We then went back to our normal day-to-day work with confidence.
Web application security best practices for app development teams
Threats like this one are common. The bigger lesson is that supply chain risk is now a top concern for any team. In fact, the OWASP Top 10 for 2025 added Software Supply Chain Failures as a new category. It sits high on the list of the most critical web application security risks.
Here are the web application security best practices we recommend to any app development team:
Open-source maintainers can help too. If you publish gems, turn on multi-factor authentication for your rubygems.org account. That one step makes it much harder for anyone to push a malicious update.
What we learned
This case is a good example of how a software development team can react fast and shield its clients. Our ISO 27001 and ISO 9001 certifications back this up. They mean security and quality are built into how we work, not bolted on later.
Solid web application security practices help us handle any cyber threat with a clear head. Looking for a trusted partner to build a secure web or mobile app? Get in touch, and we will take care of your idea from start to finish.
