Protect Sidekiq::Web mounts with authentication

#Metadata

Rule ID

ruby.security.sidekiq-web-unauthenticated-mount

Severity

high

Confidence

0.8

Languages

ruby

Presets

security, strict

Stability

stable

Applies to

block

Tags

rails, ruby, rules-catalog, security, sidekiq

#Why it matters

Unauthenticated Sidekiq Web consoles expose queues and often lead to remote code execution via job replay or configuration changes.

#Remediation

Wrap mounts in `authenticate`, add route constraints, use basic auth or VPN-only routing, and keep consoles off public networks.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/ruby/ruby.security.sidekiq-web-unauthenticated-mount.rule.yaml.