Clockwork Web prior to 0.1.2, when Rails prior to 5.2 is used, allows CSRF.
clockwork_web_project clockwork_web