Your Rails application can have a security vulnerability in code your team never wrote.

Modern SaaS products depend on open-source gems, packages, Docker images and third-party libraries.

They help us build faster.

But there's a trade-off.

A vulnerability can enter through a transitive dependency, buried several levels below the code we actually use.

We faced this while reviewing a Rails application's software supply chain.

The dependency tree had grown over time, including gems that were no longer needed.

We focused on a few things:
- Audited Gemfile.lock and transitive dependencies.
- Removed unnecessary gems.
- Added vulnerability scanning to CI.
- Reviewed Docker base images.
- Kept dependencies updated and pinned through the lockfile.

The goal wasn't to remove open source.

It was to understand what we were shipping to production.

And security scanning alone isn't enough. A clean scan today doesn't guarantee that a dependency will remain safe tomorrow.

Important learning:
Open source isn't free of responsibility just because the code is publicly available.

Every dependency adds something to maintain, update and monitor.

For a Rails SaaS, dependency management is part of production engineering, not just a developer's routine.

Build faster with open source. Stay responsible for what you ship.