Wheels 4.0 lands with 40+ security-hardening PRs — a big reason the release took the time it did. <Full Audit> Themes covered: • SQL injection — QueryBuilder property + operator validation, ORDER BY clause,

$quoteValue

escaping, scope-handler sanitization, enum WHERE clauses,

include

in UPDATE, index hints • Path traversal — partials, guideImage, MCP docs, encoded-bypass • Console / reload endpoint — POST-only

consoleeval

, constant-time comparison, rate-limiting, hash-based password • Defaults hardened — CORS wildcard → deny-all, CSRF SameSite, HSTS default-on in prod, RateLimiter

trustProxy=false

• MCP — auth gate, path-traversal guards, CSRNG session tokens, structural allowlist 7 of these are breaking. All documented with detect/fix/opt-out in the upgrade guide. <Read Full Post>