Hot Cell v1.0: Securing Active Storage in the age of AI

Today we are releasing Hot Cell v1.0, a suite of gems that moves Active Storage’s attachment processing out of your Rails application and into an unprivileged sidecar container with no network, no credentials, and nothing on its filesystem worth stealing. Adopting it is a configuration change, not a code change. It is already running in production at 37signals, in Basecamp, HEY, and Fizzy. I introduced Hot Cell at Rails World 2026 in a talk titled “Hot Cell: Securing Active Storage in the age...