Instead of deprecating the :action segment entirely, only deprecate it if there isn't a qualifier (in our case, we have a Regex whitelist). If a Regex isn't acceptable, perhaps create a specific "whitelist" constraint on the :action segment, and don't allow dynamic :actions without the whitelist constraint.

ruby-prof provides two options to specify which threads should be profiled: exclude_threads:: Array of threads which should not be profiled. include_threads:: Array of threads which should be profiled. All other threads will be ignored.

Don't try to correct user input by blacklists: This will make the attack work: "<sc<script>ript>".gsub("<script>", "")

When sanitizing, protecting or verifying something, prefer whitelists over blacklists.