railsgoat

A vulnerable version of Rails that follows the OWASP Top 10. Maintained by OWASP on GitHub, where it has earned 922 stars from the community.

It's actively developed around appsec, owasp-top, rails, and is a solid reference for anyone building with these tools.