Rails test environment turns off CSRF checks by default, so missing authenticity tokens can hide broken POST flows. Enabling forgery protection in JavaScript tests catches these failures.

Shared behavior in traits or modules can be tested once with RSpec shared example groups instead of duplicating specs for each class.

Custom RSpec matchers and support code need a clear home in spec/support to keep specs DRY and make shared helpers available everywhere.

File uploads in Rails are easy to misconfigure, causing lost files, public exposure of confidential data, and environment collisions. Existing uploads also need migration when storage paths change.

Merge requests are often rejected for avoidable issues: missing tests, debug code, UI defects, slow queries, missing indexes, or incomplete database changes.

Git can ignore machine-specific files globally instead of per repository, avoiding repeated setup and cluttered project .gitignore files.

HTTP clients can request unsupported formats and trigger ActionView::MissingTemplate when only HTML templates exist; restricting routes or responding with 406 avoids the error.

Conditional after_save callbacks can silently lose earlier :if conditions when the same method is registered twice. Combine predicates or move the logic into the callback.

Complex Rails schema changes need SQL, embedded migration models, or adapter helpers when simple add_column and update calls cannot handle existing data safely.

Empty exclusion lists in NOT IN conditions can silently return no rows; where.not in Rails 4+ handles empty arrays safely.

Time values assigned to date fields can shift a day in non-UTC apps. Use Date.current or convert future times with to_date before saving.

JavaScript has no built-in deep equality check for objects and arrays; use _.isEqual(), up.util.isEqual(), or isDeepStrictEqual() for value comparison.

Ruby class variables are shared across inheritance hierarchies and bind to the current scope at parse time, making them hard to control and easy to misuse.

Regular expressions can accept embedded newlines when ^ and $ are used; \A and \z anchor the whole string and avoid unsafe validation matches.

validates_uniqueness_of can still allow duplicate records under concurrent requests; a unique database constraint prevents the race and turns collisions into ActiveRecord::RecordNotUnique.

Custom Rails error pages can be rendered through controllers instead of static public files, allowing layouts, helpers, and tests for 404 and 500 responses.

Git commits become safer when changes are reviewed and staged in small hunks, reducing accidental additions before committing.

simple_format does not escape unsafe HTML and sanitizes generated paragraphs instead. Escape user input first or customize sanitize_options in Rails 7.1.

Rails asset URLs need fingerprints or timestamps to let browsers cache images, stylesheets, and scripts long-term without serving stale files after updates.

Temporary files in Ruby are removed automatically when no reference remains, and early unlink prevents stale paths and unauthorized access.

Move a feature branch from one base branch to another with git rebase --onto, preserving only the branch’s own commits and avoiding unrelated history.

Capistrano stores the deployed commit hash in REVISION, making the live release easy to identify on one server or across multiple hosts.

Unicode characters can break 7-bit string transport; transliteration to Low-ASCII keeps text usable where escaping is not possible.

params can contain nil, arrays, or hashes, so treating request values as plain strings can lead to unsafe lookups and unexpected matches.