railsgoat

A vulnerable version of Rails that follows the OWASP Top 10. Maintained by OWASP on GitHub, where it has earned 922 stars from the community.

It's actively developed around rails, security, appsec, and is a solid reference for anyone building with these tools.