diff --git a/.gitattributes b/.gitattributes
index 407734d..d952a2d 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,5 +1,7 @@
-*.ico binary
-*.jpg binary
-*.gif binary
-*.png binary
-*.swf binary
+# See https://git-scm.com/docs/gitattributes for more about git attribute files.
+
+# Mark the database schema as having been generated.
+db/structure.sql linguist-generated
+
+# Mark any vendored files as having been vendored.
+vendor/* linguist-vendored
diff --git a/.gitignore b/.gitignore
index 87a23f2..af6fc78 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,15 +7,35 @@
 # Ignore bundler config.
 /.bundle
 
+# Ignore all logfiles and tempfiles.
+/log/*
+/tmp/*
+!/log/.keep
+!/tmp/.keep
+
+# Ignore pidfiles, but keep the directory.
+/tmp/pids/*
+!/tmp/pids/
+!/tmp/pids/.keep
+
+# Ignore uploaded files in development.
+/storage/*
+!/storage/.keep
+/tmp/storage/*
+!/tmp/storage/
+!/tmp/storage/.keep
+
+# Ignore master key for decrypting credentials and more.
+/config/master.key
+
 # Ignore the default SQLite database.
 /db/*.sqlite3
-/db/*.sqlite3-journal
+/db/*.sqlite3-*
 /db/*.zip
 
-# Ignore all logfiles and tempfiles.
-/log/*
-!/log/.keep
-/tmp
+# Ignore all environment files.
+/.env
+/.env.*
 
 # gemini-cli settings
 .gemini/
diff --git a/CLAUDE.md b/CLAUDE.md
index 10236f6..5e9930a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -256,6 +256,118 @@ end
 - `client_ip`, `client_identity` - Track users
 - `md_to_html` - Markdown rendering
 
+## Rails Upgrade Workflow
+
+**CRITICAL REFERENCE:** This project has comprehensive Rails Upgrade Guidelines in `README.md`. **ALWAYS read and follow README.md Rails Upgrade Guidelines before starting any Rails upgrade.**
+
+### Step-by-Step Rails Upgrade Process
+
+When asked to upgrade Rails, follow this exact workflow:
+
+1. **Read README.md Guidelines First**
+   - Open and read the "Rails Upgrade Guidelines" section in README.md
+   - Understand the upgrade path methodology
+   - Note the complete diff application rules
+
+2. **Plan the Upgrade Path**
+   - Determine current Rails version (check `Gemfile.lock`)
+   - Determine target Rails version
+   - Create step-by-step upgrade path following major version increments
+   - Example: 4.2.5 → 4.2.11 → 5.0.0 → 5.2.8 → 6.0.0 → 6.1.7
+
+3. **For EACH Major Version Step**
+
+   **A. Visit railsdiff.org**
+   - Open the exact URL: `https://railsdiff.org/{from_version}/{to_version}`
+   - Review ALL file changes in the diff
+   - Make a mental note of:
+     - Files to modify
+     - **Files to create (marked as "new file")**
+     - Files to delete
+     - Directory structure changes
+
+   **B. Update Gemfile**
+   - Update Rails version
+   - Update related gems if needed for compatibility
+   - Run `bundle update rails`
+
+   **C. Apply ALL railsdiff.org Changes**
+
+   **CRITICAL: Copy files EXACTLY as shown in railsdiff.org, including:**
+   - All code lines
+   - **ALL comments** (even if they look like documentation or examples)
+   - All whitespace and formatting
+   - All empty lines
+
+   **Must create these files if they don't exist (with EXACT content from railsdiff.org):**
+   - `config/cable.yml` (Rails 5.0+)
+   - `config/storage.yml` (Rails 5.2+)
+   - `config/initializers/content_security_policy.rb` (Rails 5.2+)
+   - `config/initializers/permissions_policy.rb` (Rails 6.1+)
+   - `config/initializers/new_framework_defaults_X_Y.rb` (each major version)
+   - `bin/update` (Rails 5.0+)
+   - `app/models/application_record.rb` (Rails 5.0+)
+   - `app/jobs/application_job.rb` (Rails 5.0+) - **including retry_on and discard_on comments**
+   - `app/mailers/application_mailer.rb` (Rails 5.0+)
+   - `app/views/layouts/mailer.html.erb` and `.text.erb` (Rails 5.0+)
+
+   **Must update these files:**
+   - `.gitattributes` - Update to Rails standard format
+   - `.gitignore` - Add new ignore patterns (storage/, tmp/storage/, config/master.key, etc.)
+   - `bin/rails`, `bin/rake`, `bin/setup` - Update to modern format (remove `.exe`, use `__dir__`)
+   - `config/application.rb` - Update `config.load_defaults`
+   - `config/boot.rb` - Update requires, add bootsnap
+   - `config/environment.rb` - Update requires to use `require_relative`
+   - `config/puma.rb` - Update to Rails 6.1 format
+   - `config/environments/*.rb` - Add all new configuration options
+   - `config/database.yml` - Update comments and format if needed
+
+   **Must create directory structure:**
+   - `tmp/.keep`, `tmp/pids/.keep`, `tmp/storage/.keep`
+   - `storage/.keep`
+
+   **D. Verification Checklist**
+   - [ ] All files marked "new file" in railsdiff.org are created **with EXACT content including ALL comments**
+   - [ ] All files marked "modified" in railsdiff.org are updated **line by line, including comment changes**
+   - [ ] .gitattributes updated to Rails standard
+   - [ ] .gitignore includes all new patterns
+   - [ ] All bin/ scripts use modern format
+   - [ ] config/application.rb has correct load_defaults version
+   - [ ] All new initializers are created
+   - [ ] Directory structure is complete
+   - [ ] **Content verification**: For new files (especially ApplicationJob, ApplicationRecord, ApplicationMailer), verify comments match railsdiff.org
+
+   **E. Commit Changes**
+   - Commit gem updates separately from config updates
+   - Use descriptive commit messages
+   - Follow the commit message format from previous upgrades
+
+4. **After All Upgrades Complete**
+   - Review all commits
+   - Ensure no files were missed
+   - Push to remote branch
+
+### Common Mistakes to Avoid
+
+❌ **DO NOT:**
+- Skip creating new files from railsdiff.org
+- Only update gems without applying config changes
+- Assume existing files are sufficient
+- Skip updating .gitattributes or .gitignore
+- Forget to create new initializers
+- Leave bin/ scripts in old format
+- **Create files from memory/common knowledge - ALWAYS copy from railsdiff.org**
+- **Skip comments thinking they are optional - ALL comments must be included**
+- Create minimal/skeleton versions of files - use EXACT content
+
+✓ **DO:**
+- Create EVERY file marked as "new file" in railsdiff.org **with EXACT content**
+- Update EVERY file marked as "modified" in railsdiff.org **line by line**
+- **Include ALL comments, even if they look like documentation or examples**
+- Use the verification checklist for each version
+- Ask user if uncertain about any file
+- Follow the README.md guidelines strictly
+
 ## Development Workflow
 
 ### Getting Started
diff --git a/Gemfile b/Gemfile
index 10ec6db..f84eeb8 100644
--- a/Gemfile
+++ b/Gemfile
@@ -17,7 +17,7 @@ group :production do
 end
 
 # Use dotenv for environment variables management
-gem 'dotenv-rails'
+gem 'dotenv-rails', '~> 2.7'
 # Use Puma as the app server
 gem 'puma'
 # Use pry-rails for pry initializer
@@ -29,26 +29,28 @@ gem 'redis-rails'
 # Use Rack CORS Middleware for handling CORS
 gem 'rack-cors', require: 'rack/cors'
 # Use Simple Form as form builder
-gem 'simple_form'
+gem 'simple_form', '~> 5.0'
 # Use Slim for template
-gem 'slim-rails'
+gem 'slim-rails', '>= 3.1.0'
 # Use Ransack as search model
 gem 'ransack'
 # Use HTTParty as an HTTP client
 gem 'httparty'
 # Use fog-google for Google Cloud Platform
-gem 'fog-google'
+gem 'fog-google', '~> 1.0'
 
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
-gem 'rails', '~> 4.2.5'
+gem 'rails', '~> 6.1.7'
+# Reduces boot times through caching; required in config/boot.rb
+gem 'bootsnap', '>= 1.1.0', require: false
 # Use postgresql as the database for Active Record
-gem 'pg', '~> 0.15'
+gem 'pg', '~> 0.21'
 # Use SCSS for stylesheets
-gem 'sass-rails', '~> 5.0'
+gem 'sass-rails', '>= 6.0'
 # Use Uglifier as compressor for JavaScript assets
 gem 'uglifier', '>= 1.3.0'
 # Use CoffeeScript for .coffee assets and views
-gem 'coffee-rails', '~> 4.1.0'
+gem 'coffee-rails', '~> 4.2.0'
 # See https://github.com/rails/execjs#readme for more supported runtimes
 # gem 'therubyracer', platforms: :ruby
 
@@ -57,7 +59,7 @@ gem 'jquery-rails'
 # Turbolinks makes following links in your web application faster. Read more: https://github.com/rails/turbolinks
 # gem 'turbolinks'
 # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
-gem 'jbuilder', '~> 2.0'
+gem 'jbuilder', '~> 2.5'
 # bundle exec rake doc:rails generates the API under doc/api.
 gem 'sdoc', '~> 0.4.0', group: :doc
 
@@ -71,18 +73,18 @@ gem 'sdoc', '~> 0.4.0', group: :doc
 # gem 'capistrano-rails', group: :development
 
 # Use rails-i18n as I18n solution
-gem 'rails-i18n'
+gem 'rails-i18n', '~> 7.0'
 # Use Kaminari as paginator
 gem 'kaminari'
-# Use Nokogiri as HTML parser
-gem 'nokogiri'
+# Use Nokogiri as HTML parser (< 1.13 for Ruby 2.5 compatibility)
+gem 'nokogiri', '~> 1.12.0'
 # Use Redcarpet as Markdown parser
 gem 'redcarpet'
 # Use CodeRay for syntax highlighting
 gem 'coderay'
 
 # Use amazon-ecs for Amazon Product Advertising API
-gem 'amazon-ecs'
+gem 'amazon-ecs', '~> 2.6'
 # Use http_accept_language help detect the users preferred language
 gem 'http_accept_language'
 
@@ -103,6 +105,8 @@ end
 group :development, :test do
   # Call 'byebug' anywhere in the code to stop execution and get a debugger console
   gem 'byebug'
+  # Required for assigns and assert_template in tests
+  gem 'rails-controller-testing'
 end
 
 group :development do
@@ -119,10 +123,6 @@ group :development do
 
   # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
   gem 'spring'
-  # Use Quiet Assets to mute assets pipeline log messages
-  gem 'quiet_assets'
-  # Use RealFaviconGenerator as favicon generator
-  gem 'rails_real_favicon'
   # Use RuboCop for Ruby code analysis
   gem 'rubocop', require: false
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index 0386e98..85d1bd3 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,359 +2,512 @@ GEM
   remote: https://rubygems.org/
   remote: https://rails-assets.org/
   specs:
-    actionmailer (4.2.10)
-      actionpack (= 4.2.10)
-      actionview (= 4.2.10)
-      activejob (= 4.2.10)
+    actioncable (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+    actionmailbox (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+      mail (>= 2.7.1)
+    actionmailer (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      actionview (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.10)
-      actionview (= 4.2.10)
-      activesupport (= 4.2.10)
-      rack (~> 1.6)
-      rack-test (~> 0.6.2)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.10)
-      activesupport (= 4.2.10)
-      builder (~> 3.1)
-      erubis (~> 2.7.0)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (4.2.10)
-      activesupport (= 4.2.10)
-      globalid (>= 0.3.0)
-    activemodel (4.2.10)
-      activesupport (= 4.2.10)
+      rails-dom-testing (~> 2.0)
+    actionpack (6.1.7.10)
+      actionview (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+      rack (~> 2.0, >= 2.0.9)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.2.0)
+    actiontext (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+      nokogiri (>= 1.8.5)
+    actionview (6.1.7.10)
+      activesupport (= 6.1.7.10)
       builder (~> 3.1)
-    activerecord (4.2.10)
-      activemodel (= 4.2.10)
-      activesupport (= 4.2.10)
-      arel (~> 6.0)
-    activesupport (4.2.10)
-      i18n (~> 0.7)
-      minitest (~> 5.1)
-      thread_safe (~> 0.3, >= 0.3.4)
-      tzinfo (~> 1.1)
-    amazon-ecs (2.4.0)
-      nokogiri (~> 1.4)
-      ruby-hmac (~> 0.3)
-    arel (6.0.4)
-    ast (2.3.0)
+      erubi (~> 1.4)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    activejob (6.1.7.10)
+      activesupport (= 6.1.7.10)
+      globalid (>= 0.3.6)
+    activemodel (6.1.7.10)
+      activesupport (= 6.1.7.10)
+    activerecord (6.1.7.10)
+      activemodel (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+    activestorage (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+      marcel (~> 1.0)
+      mini_mime (>= 1.1.0)
+    activesupport (6.1.7.10)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
+    addressable (2.8.8)
+      public_suffix (>= 2.0.2, < 8.0)
+    amazon-ecs (2.6.0)
+      nokogiri (~> 1.10)
+    ast (2.4.3)
     babel-source (5.8.35)
     babel-transpiler (0.7.0)
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
-    better_errors (2.8.0)
-      coderay (>= 1.0.0)
+    base64 (0.3.0)
+    better_errors (2.10.1)
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
-    binding_of_caller (0.7.2)
-      debug_inspector (>= 0.0.1)
-    builder (3.2.4)
-    byebug (9.0.0)
-    cloudflare-rails (0.1.1)
+      rouge (>= 1.0.0)
+    binding_of_caller (1.0.1)
+      debug_inspector (>= 1.2.0)
+    bootsnap (1.13.0)
+      msgpack (~> 1.2)
+    builder (3.3.0)
+    byebug (11.1.3)
+    cloudflare-rails (2.0.0)
+      actionpack (>= 5.0, < 6.2.0)
+      activesupport (>= 5.0, < 6.2.0)
       httparty
-      rails (>= 4.0)
-    coderay (1.1.1)
-    coffee-rails (4.1.1)
+      railties (>= 5.0, < 6.2.0)
+    coderay (1.1.3)
+    coffee-rails (4.2.2)
       coffee-script (>= 2.2.0)
-      railties (>= 4.0.0, < 5.1.x)
+      railties (>= 4.0.0)
     coffee-script (2.4.1)
       coffee-script-source
       execjs
-    coffee-script-source (1.10.0)
-    concurrent-ruby (1.2.2)
+    coffee-script-source (1.12.2)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.5)
     crass (1.0.6)
-    debug_inspector (0.0.2)
-    domain_name (0.5.20160310)
-      unf (>= 0.0.5, < 1.0.0)
-    dotenv (2.1.1)
-    dotenv-rails (2.1.1)
-      dotenv (= 2.1.1)
-      railties (>= 4.0, < 5.1)
-    erubi (1.10.0)
-    erubis (2.7.0)
-    excon (0.71.0)
-    execjs (2.7.0)
-    fog-core (1.43.0)
+    debug_inspector (1.2.0)
+    declarative (0.0.20)
+    digest (3.2.1)
+    dotenv (2.8.1)
+    dotenv-rails (2.8.1)
+      dotenv (= 2.8.1)
+      railties (>= 3.2)
+    erubi (1.13.1)
+    excon (0.109.0)
+    execjs (2.10.0)
+    faraday (1.10.4)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.1)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.1.1)
+      multipart-post (~> 2.0)
+    faraday-net_http (1.0.2)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    ffi (1.17.2)
+    fog-core (2.5.0)
       builder
-      excon (~> 0.49)
-      formatador (~> 0.2)
-    fog-google (0.1.0)
+      excon (~> 0.71)
+      formatador (>= 0.2, < 2.0)
+      mime-types
+    fog-google (1.26.0)
+      addressable (>= 2.7.0)
+      fog-core (~> 2.5)
+      fog-json (~> 1.2)
+      fog-xml (~> 0.1.0)
+      google-apis-compute_v1 (~> 0.53)
+      google-apis-dns_v1 (~> 0.28)
+      google-apis-iamcredentials_v1 (~> 0.15)
+      google-apis-monitoring_v3 (~> 0.37)
+      google-apis-pubsub_v1 (~> 0.30)
+      google-apis-sqladmin_v1beta4 (~> 0.38)
+      google-apis-storage_v1 (>= 0.19, < 1)
+      google-cloud-env (>= 1.2, < 3.0)
+    fog-json (1.2.0)
       fog-core
-      fog-json
-      fog-xml
-    fog-json (1.0.2)
-      fog-core (~> 1.0)
       multi_json (~> 1.10)
-    fog-xml (0.1.2)
+    fog-xml (0.1.5)
       fog-core
-      nokogiri (~> 1.5, >= 1.5.11)
-    font-awesome-sass (4.6.2)
-      sass (>= 3.2)
-    formatador (0.2.5)
-    foundation-rails (6.2.1.0)
+      nokogiri (>= 1.5.11, < 2.0.0)
+    font-awesome-sass (6.7.2)
+      sassc (~> 2.0)
+    formatador (1.2.3)
+      reline
+    foundation-rails (6.9.0.0)
       railties (>= 3.1.0)
-      sass (>= 3.3.0, < 3.5)
-      sprockets-es6 (>= 0.9.0)
-    globalid (0.4.1)
-      activesupport (>= 4.2.0)
-    http-cookie (1.0.2)
-      domain_name (~> 0.5)
-    http_accept_language (2.0.5)
+      sassc
+      sprockets-es6
+    globalid (1.2.1)
+      activesupport (>= 6.1)
+    google-apis-compute_v1 (0.86.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-core (0.11.3)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (>= 0.16.2, < 2.a)
+      httpclient (>= 2.8.1, < 3.a)
+      mini_mime (~> 1.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+      rexml
+    google-apis-dns_v1 (0.36.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-iamcredentials_v1 (0.17.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-monitoring_v3 (0.54.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-pubsub_v1 (0.45.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-sqladmin_v1beta4 (0.61.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-storage_v1 (0.32.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-cloud-env (1.6.0)
+      faraday (>= 0.17.3, < 3.0)
+    googleauth (1.1.3)
+      faraday (>= 0.17.3, < 3.a)
+      jwt (>= 1.4, < 3.0)
+      memoist (~> 0.16)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    http_accept_language (2.1.1)
     httparty (0.21.0)
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    i18n (0.9.5)
+    httpclient (2.9.0)
+      mutex_m
+    i18n (1.14.7)
       concurrent-ruby (~> 1.0)
-    jbuilder (2.4.1)
-      activesupport (>= 3.0.0, < 5.1)
-      multi_json (~> 1.2)
-    jquery-rails (4.4.0)
+    io-console (0.5.9)
+    io-wait (0.3.1)
+    jbuilder (2.13.0)
+      actionview (>= 5.0.0)
+      activesupport (>= 5.0.0)
+    jquery-rails (4.6.1)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
     json (1.8.6)
-    kaminari (1.2.1)
+    jwt (2.10.2)
+      base64
+    kaminari (1.2.2)
       activesupport (>= 4.1.0)
-      kaminari-actionview (= 1.2.1)
-      kaminari-activerecord (= 1.2.1)
-      kaminari-core (= 1.2.1)
-    kaminari-actionview (1.2.1)
+      kaminari-actionview (= 1.2.2)
+      kaminari-activerecord (= 1.2.2)
+      kaminari-core (= 1.2.2)
+    kaminari-actionview (1.2.2)
       actionview
-      kaminari-core (= 1.2.1)
-    kaminari-activerecord (1.2.1)
+      kaminari-core (= 1.2.2)
+    kaminari-activerecord (1.2.2)
       activerecord
-      kaminari-core (= 1.2.1)
-    kaminari-core (1.2.1)
-    lograge (0.3.6)
-      actionpack (>= 3)
-      activesupport (>= 3)
-      railties (>= 3)
-    loofah (2.20.0)
+      kaminari-core (= 1.2.2)
+    kaminari-core (1.2.2)
+    logger (1.7.0)
+    lograge (0.14.0)
+      actionpack (>= 4)
+      activesupport (>= 4)
+      railties (>= 4)
+      request_store (~> 1.0)
+    loofah (2.24.1)
       crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
-    mail (2.7.0)
+      nokogiri (>= 1.12.0)
+    mail (2.9.0)
+      logger
       mini_mime (>= 0.1.1)
-    method_source (0.8.2)
-    mime-types (2.99.3)
-    mini_mime (1.0.0)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.1.0)
+    memoist (0.16.2)
+    method_source (1.1.0)
+    mime-types (3.7.0)
+      logger
+      mime-types-data (~> 3.2025, >= 3.2025.0507)
+    mime-types-data (3.2025.0924)
+    mini_mime (1.1.2)
     mini_portile2 (2.6.1)
     minitest (5.15.0)
-    multi_json (1.12.0)
+    msgpack (1.8.0)
+    multi_json (1.15.0)
     multi_xml (0.6.0)
-    netrc (0.11.0)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    net-imap (0.2.2)
+      digest
+      net-protocol
+      strscan
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.1.2)
+      io-wait
+      timeout
+    net-smtp (0.3.0)
+      digest
+      net-protocol
+      timeout
     nio4r (2.7.3)
     nokogiri (1.12.5)
       mini_portile2 (~> 2.6.1)
       racc (~> 1.4)
-    parallel (1.12.0)
-    parser (2.4.0.2)
-      ast (~> 2.3)
-    pg (0.18.4)
-    polyamorous (1.3.0)
-      activerecord (>= 3.0)
-    powder (0.3.0)
+    os (1.1.4)
+    parallel (1.24.0)
+    parser (3.3.10.0)
+      ast (~> 2.4.1)
+      racc
+    pg (0.21.0)
+    polyamorous (2.3.0)
+      activerecord (>= 5.0)
+    powder (0.4.0)
       thor (>= 0.11.5)
-    powerpack (0.1.1)
-    pry (0.10.3)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    pry-rails (0.3.4)
-      pry (>= 0.9.10)
+    pry (0.15.2)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    pry-rails (0.3.11)
+      pry (>= 0.13.0)
     pry-remote (0.1.8)
       pry (~> 0.9)
       slop (~> 3.0)
-    puma (5.6.9)
+    public_suffix (4.0.7)
+    puma (6.6.1)
       nio4r (~> 2.0)
-    quiet_assets (1.1.0)
-      railties (>= 3.1, < 5.0)
-    racc (1.6.2)
-    rack (1.6.13)
-    rack-cors (1.0.6)
-      rack (>= 1.6.0)
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (4.2.10)
-      actionmailer (= 4.2.10)
-      actionpack (= 4.2.10)
-      actionview (= 4.2.10)
-      activejob (= 4.2.10)
-      activemodel (= 4.2.10)
-      activerecord (= 4.2.10)
-      activesupport (= 4.2.10)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.10)
-      sprockets-rails
-    rails-assets-intro.js (2.1.0)
+    racc (1.8.1)
+    rack (2.2.21)
+    rack-cors (2.0.2)
+      rack (>= 2.0.0)
+    rack-session (1.0.2)
+      rack (< 3)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rails (6.1.7.10)
+      actioncable (= 6.1.7.10)
+      actionmailbox (= 6.1.7.10)
+      actionmailer (= 6.1.7.10)
+      actionpack (= 6.1.7.10)
+      actiontext (= 6.1.7.10)
+      actionview (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activemodel (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+      bundler (>= 1.15.0)
+      railties (= 6.1.7.10)
+      sprockets-rails (>= 2.0.0)
+    rails-assets-intro.js (8.3.2)
     rails-assets-jplayer (2.9.2)
       rails-assets-jquery (>= 1.7.2)
-    rails-assets-jquery (2.2.3)
+    rails-assets-jquery (3.7.1)
     rails-assets-nprogress (0.2.0)
-    rails-deprecated_sanitizer (1.0.4)
-      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.9)
-      activesupport (>= 4.2.0, < 5.0)
-      nokogiri (~> 1.6)
-      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-controller-testing (1.0.5)
+      actionpack (>= 5.0.1.rc1)
+      actionview (>= 5.0.1.rc1)
+      activesupport (>= 5.0.1.rc1)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
     rails-html-sanitizer (1.5.0)
       loofah (~> 2.19, >= 2.19.1)
-    rails-i18n (4.0.8)
-      i18n (~> 0.7)
-      railties (~> 4.0)
+    rails-i18n (7.0.10)
+      i18n (>= 0.7, < 2)
+      railties (>= 6.0.0, < 8)
     rails_12factor (0.0.3)
       rails_serve_static_assets
       rails_stdout_logging
-    rails_real_favicon (0.0.3)
-      json (~> 1.7)
-      rails (>= 3.1, < 5)
-      rest-client (~> 1.8)
-      rubyzip (~> 1)
     rails_serve_static_assets (0.0.5)
     rails_stdout_logging (0.0.5)
-    railties (4.2.10)
-      actionpack (= 4.2.10)
-      activesupport (= 4.2.10)
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-    rainbow (2.2.2)
-      rake
-    rake (13.0.6)
-    ransack (1.7.0)
-      actionpack (>= 3.0)
-      activerecord (>= 3.0)
-      activesupport (>= 3.0)
+    railties (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+      method_source
+      rake (>= 12.2)
+      thor (~> 1.0)
+    rainbow (3.1.1)
+    rake (13.3.1)
+    ransack (2.3.0)
+      actionpack (>= 5.0)
+      activerecord (>= 5.0)
+      activesupport (>= 5.0)
       i18n
-      polyamorous (~> 1.2)
-    rdoc (4.2.2)
-      json (~> 1.4)
-    redcarpet (3.5.1)
-    redis (4.0.1)
-    redis-actionpack (5.0.2)
-      actionpack (>= 4.0, < 6)
-      redis-rack (>= 1, < 3)
+      polyamorous (= 2.3.0)
+    rdoc (4.3.0)
+    redcarpet (3.6.1)
+    redis (5.1.0)
+      redis-client (>= 0.17.0)
+    redis-actionpack (5.4.0)
+      actionpack (>= 5, < 8)
+      redis-rack (>= 2.1.0, < 4)
       redis-store (>= 1.1.0, < 2)
-    redis-activesupport (5.0.4)
-      activesupport (>= 3, < 6)
+    redis-activesupport (5.3.0)
+      activesupport (>= 3, < 8)
       redis-store (>= 1.3, < 2)
-    redis-rack (2.0.3)
-      rack (>= 1.5, < 3)
+    redis-client (0.19.1)
+      connection_pool
+    redis-rack (3.0.0)
+      rack-session (>= 0.2.0)
       redis-store (>= 1.2, < 2)
     redis-rails (5.0.2)
       redis-actionpack (>= 5.0, < 6)
       redis-activesupport (>= 5.0, < 6)
       redis-store (>= 1.2, < 2)
-    redis-store (1.4.1)
-      redis (>= 2.2, < 5)
-    rest-client (1.8.0)
-      http-cookie (>= 1.0.2, < 2.0)
-      mime-types (>= 1.16, < 3.0)
-      netrc (~> 0.7)
-    rubocop (0.51.0)
+    redis-store (1.11.0)
+      redis (>= 4, < 6)
+    regexp_parser (2.11.3)
+    reline (0.3.1)
+      io-console (~> 0.5)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    request_store (1.7.0)
+      rack (>= 1.4)
+    retriable (3.1.2)
+    rexml (3.4.4)
+    rouge (3.30.0)
+    rubocop (1.28.2)
       parallel (~> 1.10)
-      parser (>= 2.3.3.1, < 3.0)
-      powerpack (~> 0.1)
-      rainbow (>= 2.2.2, < 3.0)
+      parser (>= 3.1.0.0)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
+      rexml
+      rubocop-ast (>= 1.17.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
-    ruby-hmac (0.4.0)
-    ruby-progressbar (1.9.0)
-    rubyzip (1.3.0)
-    sass (3.4.25)
-    sass-rails (5.0.7)
-      railties (>= 4.0.0, < 6)
-      sass (~> 3.1)
-      sprockets (>= 2.8, < 4.0)
-      sprockets-rails (>= 2.0, < 4.0)
-      tilt (>= 1.1, < 3)
-    sdoc (0.4.1)
+      unicode-display_width (>= 1.4.0, < 3.0)
+    rubocop-ast (1.17.0)
+      parser (>= 3.1.1.0)
+    ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
+    sass-rails (6.0.0)
+      sassc-rails (~> 2.1, >= 2.1.1)
+    sassc (2.4.0)
+      ffi (~> 1.9)
+    sassc-rails (2.1.2)
+      railties (>= 4.0.0)
+      sassc (>= 2.0)
+      sprockets (> 3.0)
+      sprockets-rails
+      tilt
+    sdoc (0.4.2)
       json (~> 1.7, >= 1.7.7)
       rdoc (~> 4.0)
-    simple_form (3.2.1)
-      actionpack (> 4, < 5.1)
-      activemodel (> 4, < 5.1)
-    slim (3.0.6)
-      temple (~> 0.7.3)
-      tilt (>= 1.3.3, < 2.1)
-    slim-rails (3.0.1)
-      actionmailer (>= 3.1, < 5.0)
-      actionpack (>= 3.1, < 5.0)
-      activesupport (>= 3.1, < 5.0)
-      railties (>= 3.1, < 5.0)
-      slim (~> 3.0)
+    signet (0.16.1)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.0)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    simple_form (5.3.1)
+      actionpack (>= 5.2)
+      activemodel (>= 5.2)
+    slim (5.2.1)
+      temple (~> 0.10.0)
+      tilt (>= 2.1.0)
+    slim-rails (3.7.0)
+      actionpack (>= 3.1)
+      railties (>= 3.1)
+      slim (>= 3.0, < 6.0, != 5.0.0)
     slop (3.6.0)
-    spring (1.7.1)
-    sprockets (3.7.2)
+    spring (3.1.1)
+    sprockets (4.2.2)
       concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
+      logger
+      rack (>= 2.2.4, < 4)
     sprockets-es6 (0.9.2)
       babel-source (>= 5.8.11)
       babel-transpiler
       sprockets (>= 3.0.0)
-    sprockets-rails (3.2.1)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
+    sprockets-rails (3.5.2)
+      actionpack (>= 6.1)
+      activesupport (>= 6.1)
       sprockets (>= 3.0.0)
-    temple (0.7.6)
-    thor (1.2.1)
-    thread_safe (0.3.6)
-    tilt (2.0.8)
-    tzinfo (1.2.11)
-      thread_safe (~> 0.1)
-    uglifier (3.0.0)
+    strscan (3.1.5)
+    temple (0.10.4)
+    thor (1.2.2)
+    tilt (2.6.1)
+    timeout (0.4.0)
+    trailblazer-option (0.1.2)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uber (0.1.0)
+    uglifier (4.2.1)
       execjs (>= 0.3.0, < 3)
-    unf (0.1.4)
-      unf_ext
-    unf_ext (0.0.7.2)
-    unicode-display_width (1.3.0)
+    unicode-display_width (2.6.0)
+    websocket-driver (0.8.0)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    zeitwerk (2.6.18)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  amazon-ecs
+  amazon-ecs (~> 2.6)
   better_errors
   binding_of_caller
+  bootsnap (>= 1.1.0)
   byebug
   cloudflare-rails
   coderay
-  coffee-rails (~> 4.1.0)
-  dotenv-rails
-  fog-google
+  coffee-rails (~> 4.2.0)
+  dotenv-rails (~> 2.7)
+  fog-google (~> 1.0)
   font-awesome-sass
   foundation-rails
   http_accept_language
   httparty
-  jbuilder (~> 2.0)
+  jbuilder (~> 2.5)
   jquery-rails
   kaminari
   lograge
-  nokogiri
-  pg (~> 0.15)
+  nokogiri (~> 1.12.0)
+  pg (~> 0.21)
   powder
   pry-rails
   pry-remote
   puma
-  quiet_assets
   rack-cors
-  rails (~> 4.2.5)
+  rails (~> 6.1.7)
   rails-assets-intro.js!
   rails-assets-jplayer!
   rails-assets-nprogress!
-  rails-i18n
+  rails-controller-testing
+  rails-i18n (~> 7.0)
   rails_12factor
-  rails_real_favicon
   ransack
   redcarpet
   redis
   redis-rails
   rubocop
-  sass-rails (~> 5.0)
+  sass-rails (>= 6.0)
   sdoc (~> 0.4.0)
-  simple_form
-  slim-rails
+  simple_form (~> 5.0)
+  slim-rails (>= 3.1.0)
   spring
   uglifier (>= 1.3.0)
 
diff --git a/README.md b/README.md
index 0d267f7..aa918db 100644
--- a/README.md
+++ b/README.md
@@ -57,11 +57,29 @@ Follow this complete upgrade path:
 ### 2. Complete Diff Application Rules
 
 - **Use [railsdiff.org](https://railsdiff.org/)** to compare differences between versions
+  - **CRITICAL:** Visit the **exact URL** for the version range: `https://railsdiff.org/{from_version}/{to_version}`
+  - Example: For 4.2.10 → 6.1.7.10, visit `https://railsdiff.org/4.2.10/6.1.7.10`
 - **Apply ALL changes completely**, including:
-  - Configuration file updates
-  - Comment modifications (e.g., `http://` → `https://`)
-  - Framework default changes
-  - Deprecation warnings
+  - **Modified files:** Update all existing configuration files **line by line**
+  - **New files:** Create ALL new files shown in the diff with **EXACT content** including:
+    - All code
+    - All comments (even if they seem optional or documentation-only)
+    - All whitespace and formatting
+    - Examples: `config/cable.yml`, `config/storage.yml`, `bin/update`, `app/jobs/application_job.rb`, initializers
+  - **Deleted files:** Remove files that are no longer needed
+  - **Directory structure:** Create new directories with `.keep` files (e.g., `tmp/`, `storage/`)
+  - **Comment modifications:** Update all comments (e.g., `http://` → `https://`, documentation improvements)
+  - **Framework default changes:** Apply all new framework defaults
+  - **Deprecation warnings:** Address all deprecations
+- **Verification checklist after applying diff:**
+  1. ✓ All files marked as "new file" in railsdiff.org are created **with exact content including all comments**
+  2. ✓ All files marked as "modified" in railsdiff.org are updated **line by line, including comment changes**
+  3. ✓ All files marked as "deleted" in railsdiff.org are removed
+  4. ✓ `.gitattributes` and `.gitignore` are updated to Rails standard
+  5. ✓ All `bin/` scripts are updated to modern format (no `.exe`, use `__dir__`, double quotes)
+  6. ✓ Configuration files in `config/environments/` include all new settings
+  7. ✓ New initializers are created (e.g., `content_security_policy.rb`, `permissions_policy.rb`)
+  8. ✓ **Content match verification**: For new files, verify that comments, formatting, and documentation match railsdiff.org exactly
 - **When encountering conflicts:**
   - **STOP the upgrade process**
   - Document the conflict
diff --git a/app/jobs/application_job.rb b/app/jobs/application_job.rb
new file mode 100644
index 0000000..d394c3d
--- /dev/null
+++ b/app/jobs/application_job.rb
@@ -0,0 +1,7 @@
+class ApplicationJob < ActiveJob::Base
+  # Automatically retry jobs that encountered a deadlock
+  # retry_on ActiveRecord::Deadlocked
+
+  # Most jobs are safe to ignore if the underlying records are no longer available
+  # discard_on ActiveJob::DeserializationError
+end
diff --git a/app/mailers/application_mailer.rb b/app/mailers/application_mailer.rb
new file mode 100644
index 0000000..d84cb6e
--- /dev/null
+++ b/app/mailers/application_mailer.rb
@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+class ApplicationMailer < ActionMailer::Base
+  default from: 'from@example.com'
+  layout 'mailer'
+end
diff --git a/app/models/application_record.rb b/app/models/application_record.rb
new file mode 100644
index 0000000..71fbba5
--- /dev/null
+++ b/app/models/application_record.rb
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class ApplicationRecord < ActiveRecord::Base
+  self.abstract_class = true
+end
diff --git a/app/views/layouts/mailer.html.erb b/app/views/layouts/mailer.html.erb
new file mode 100644
index 0000000..cbd34d2
--- /dev/null
+++ b/app/views/layouts/mailer.html.erb
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <style>
+      /* Email styles need to be inline */
+    </style>
+  </head>
+
+  <body>
+    <%= yield %>
+  </body>
+</html>
diff --git a/app/views/layouts/mailer.text.erb b/app/views/layouts/mailer.text.erb
new file mode 100644
index 0000000..37f0bdd
--- /dev/null
+++ b/app/views/layouts/mailer.text.erb
@@ -0,0 +1 @@
+<%= yield %>
diff --git a/bin/rails b/bin/rails
index c9a0f38..efc0377 100644
--- a/bin/rails
+++ b/bin/rails
@@ -1,4 +1,4 @@
-#!/usr/bin/env ruby.exe
-APP_PATH = File.expand_path('../../config/application', __FILE__)
-require_relative '../config/boot'
-require 'rails/commands'
+#!/usr/bin/env ruby
+APP_PATH = File.expand_path("../config/application", __dir__)
+require_relative "../config/boot"
+require "rails/commands"
diff --git a/bin/rake b/bin/rake
index f6ed5a2..4fbf10b 100644
--- a/bin/rake
+++ b/bin/rake
@@ -1,4 +1,4 @@
-#!/usr/bin/env ruby.exe
-require_relative '../config/boot'
-require 'rake'
+#!/usr/bin/env ruby
+require_relative "../config/boot"
+require "rake"
 Rake.application.run
diff --git a/bin/setup b/bin/setup
index 2d041ee..ec47b79 100644
--- a/bin/setup
+++ b/bin/setup
@@ -1,29 +1,33 @@
-#!/usr/bin/env ruby.exe
-require 'pathname'
+#!/usr/bin/env ruby
+require "fileutils"
 
 # path to your application root.
-APP_ROOT = Pathname.new File.expand_path('../../',  __FILE__)
+APP_ROOT = File.expand_path("..", __dir__)
 
-Dir.chdir APP_ROOT do
-  # This script is a starting point to setup your application.
-  # Add necessary setup steps to this file:
+def system!(*args)
+  system(*args) || abort("\n== Command #{args} failed ==")
+end
+
+FileUtils.chdir APP_ROOT do
+  # This script is a way to set up or update your development environment automatically.
+  # This script is idempotent, so that you can run it at any time and get an expectable outcome.
+  # Add necessary setup steps to this file.
 
   puts "== Installing dependencies =="
-  system "gem install bundler --conservative"
-  system "bundle check || bundle install"
+  system! "gem install bundler --conservative"
+  system("bundle check") || system!("bundle install")
 
   # puts "\n== Copying sample files =="
   # unless File.exist?("config/database.yml")
-  #   system "cp config/database.yml.sample config/database.yml"
+  #   FileUtils.cp "config/database.yml.sample", "config/database.yml"
   # end
 
   puts "\n== Preparing database =="
-  system "bin/rake db:setup"
+  system! "bin/rails db:prepare"
 
   puts "\n== Removing old logs and tempfiles =="
-  system "rm -f log/*"
-  system "rm -rf tmp/cache"
+  system! "bin/rails log:clear tmp:clear"
 
   puts "\n== Restarting application server =="
-  system "touch tmp/restart.txt"
+  system! "bin/rails restart"
 end
diff --git a/bin/update b/bin/update
new file mode 100755
index 0000000..253c726
--- /dev/null
+++ b/bin/update
@@ -0,0 +1,27 @@
+#!/usr/bin/env ruby
+require "fileutils"
+
+# path to your application root.
+APP_ROOT = File.expand_path("..", __dir__)
+
+def system!(*args)
+  system(*args) || abort("\n== Command #{args} failed ==")
+end
+
+FileUtils.chdir APP_ROOT do
+  # This script is a way to update your development environment automatically.
+  # Add necessary update steps to this file.
+
+  puts "== Installing dependencies =="
+  system! "gem install bundler --conservative"
+  system("bundle check") || system!("bundle install")
+
+  puts "\n== Updating database =="
+  system! "bin/rails db:migrate"
+
+  puts "\n== Removing old logs and tempfiles =="
+  system! "bin/rails log:clear tmp:clear"
+
+  puts "\n== Restarting application server =="
+  system! "bin/rails restart"
+end
diff --git a/config/application.rb b/config/application.rb
index 9eac5e5..1e1f162 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -1,4 +1,4 @@
-require File.expand_path('../boot', __FILE__)
+require_relative 'boot'
 
 require 'rails/all'
 
@@ -8,6 +8,9 @@
 
 module Kiris
   class Application < Rails::Application
+    # Initialize configuration defaults for originally generated Rails version.
+    config.load_defaults 6.1
+
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration should go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded.
@@ -24,9 +27,6 @@ class Application < Rails::Application
     config.i18n.available_locales = %I{en ja zh-Hans zh-Hant}
     config.i18n.default_locale = %s{en}
 
-    # Do not swallow errors in after_commit/after_rollback callbacks.
-    config.active_record.raise_in_transactional_callbacks = true
-
     config.middleware.insert_before 0, 'Rack::Cors' do
       allow do
         origins '*'
diff --git a/config/boot.rb b/config/boot.rb
index 6b750f0..b9e460c 100644
--- a/config/boot.rb
+++ b/config/boot.rb
@@ -1,3 +1,4 @@
-ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
 
 require 'bundler/setup' # Set up gems listed in the Gemfile.
+require 'bootsnap/setup' # Speed up boot time by caching expensive operations.
diff --git a/config/cable.yml b/config/cable.yml
new file mode 100644
index 0000000..8603041
--- /dev/null
+++ b/config/cable.yml
@@ -0,0 +1,10 @@
+development:
+  adapter: async
+
+test:
+  adapter: test
+
+production:
+  adapter: redis
+  url: <%= ENV.fetch("REDIS_URL") { "redis://localhost:6379/1" } %>
+  channel_prefix: kiris_production
diff --git a/config/environment.rb b/config/environment.rb
index ee8d90d..426333b 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -1,5 +1,5 @@
 # Load the Rails application.
-require File.expand_path('../application', __FILE__)
+require_relative 'application'
 
 # Initialize the Rails application.
 Rails.application.initialize!
diff --git a/config/environments/development.rb b/config/environments/development.rb
index ad681fc..8265343 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -16,9 +16,14 @@
   # Use a different cache store in production.
   config.cache_store = :memory_store, { size: 32.megabytes }
 
+  # Store uploaded files on the local file system (see config/storage.yml for options).
+  config.active_storage.service = :local
+
   # Don't care if the mailer can't send.
   config.action_mailer.raise_delivery_errors = false
 
+  config.action_mailer.perform_caching = false
+
   # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
   # the I18n.default_locale when a translation can not be found).
   config.i18n.fallbacks = true
diff --git a/config/environments/production.rb b/config/environments/production.rb
index ae02dde..c05d4c3 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -22,8 +22,12 @@
 
   # Disable serving static files from the `/public` folder by default since
   # Apache or NGINX already handles this.
-  config.serve_static_files = ENV['RAILS_SERVE_STATIC_FILES'].present?
-  config.static_cache_control = "public, max-age=#{365.days}"
+  config.public_file_server.enabled = ENV['RAILS_SERVE_STATIC_FILES'].present?
+
+  # Enable public file server with far-future expires headers
+  config.public_file_server.headers = {
+    'Cache-Control' => "public, max-age=#{365.days.to_i}"
+  }
 
   # Compress JavaScripts and CSS.
   config.assets.js_compressor = :uglifier
@@ -62,12 +66,18 @@
   # Use a different cache store in production.
   config.cache_store = :redis_store, ENV['REDIS_URL'], { expires_in: 1.year }
 
+  # Store uploaded files on the local file system (see config/storage.yml for options).
+  config.active_storage.service = :local
+
   # Enable serving of images, stylesheets, and JavaScripts from an asset server.
   # config.action_controller.asset_host = 'http://assets.example.com'
 
   # Ignore bad email addresses and do not raise email delivery errors.
   # Set this to true and configure the email server for immediate delivery to raise delivery errors.
   # config.action_mailer.raise_delivery_errors = false
+
+  config.action_mailer.perform_caching = false
+
   config.action_mailer.smtp_settings = {
     :port           => ENV['MAILGUN_SMTP_PORT'],
     :address        => ENV['MAILGUN_SMTP_SERVER'],
diff --git a/config/environments/test.rb b/config/environments/test.rb
index 6f93994..368b9ab 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -12,14 +12,19 @@
   # preloads Rails for running tests, you may have to set it to true.
   config.eager_load = false
 
-  # Configure static file server for tests with Cache-Control for performance.
-  config.serve_static_files   = true
-  config.static_cache_control = 'public, max-age=3600'
+  # Configure public file server for tests with Cache-Control for performance.
+  config.public_file_server.enabled = true
+  config.public_file_server.headers = {
+    'Cache-Control' => 'public, max-age=3600'
+  }
 
   # Show full error reports and disable caching.
   config.consider_all_requests_local       = true
   config.action_controller.perform_caching = false
 
+  # Store uploaded files on the local file system in a temporary directory.
+  config.active_storage.service = :test
+
   # Raise exceptions instead of rendering exception templates.
   config.action_dispatch.show_exceptions = false
 
@@ -31,8 +36,7 @@
   # ActionMailer::Base.deliveries array.
   config.action_mailer.delivery_method = :test
 
-  # Randomize the order test cases are executed.
-  config.active_support.test_order = :random
+  config.action_mailer.perform_caching = false
 
   # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
   # the I18n.default_locale when a translation can not be found).
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
new file mode 100644
index 0000000..54f47cf
--- /dev/null
+++ b/config/initializers/content_security_policy.rb
@@ -0,0 +1,25 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for permitted importmap and inline scripts
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src)
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end
diff --git a/config/initializers/new_framework_defaults_5_0.rb b/config/initializers/new_framework_defaults_5_0.rb
new file mode 100644
index 0000000..15d8771
--- /dev/null
+++ b/config/initializers/new_framework_defaults_5_0.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+#
+# This file contains migration options to ease your Rails 5.0 upgrade.
+#
+# Once upgraded flip defaults one by one to migrate to the new default.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+
+# Enable per-form CSRF tokens. Previous versions had false.
+Rails.application.config.action_controller.per_form_csrf_tokens = true
+
+# Enable origin-checking CSRF mitigation. Previous versions had false.
+Rails.application.config.action_controller.forgery_protection_origin_check = true
+
+# Make Ruby 2.4 preserve the timezone of the receiver when calling `to_time`.
+# Previous versions had false.
+ActiveSupport.to_time_preserves_timezone = true
+
+# Require `belongs_to` associations by default. Previous versions had false.
+Rails.application.config.active_record.belongs_to_required_by_default = true
+
+# Do not halt callback chains when a callback returns false. Previous versions had true.
+ActiveSupport.halt_callback_chains_on_return_false = false
+
+# Configure SSL options to enable HSTS with subdomains. Previous versions had false.
+Rails.application.config.ssl_options = { hsts: { subdomains: true } }
diff --git a/config/initializers/new_framework_defaults_5_1.rb b/config/initializers/new_framework_defaults_5_1.rb
new file mode 100644
index 0000000..e966dde
--- /dev/null
+++ b/config/initializers/new_framework_defaults_5_1.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+#
+# This file contains migration options to ease your Rails 5.1 upgrade.
+#
+# Once upgraded flip defaults one by one to migrate to the new default.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+
+# Make `form_with` generate non-remote forms.
+Rails.application.config.action_view.form_with_generates_remote_forms = true
+
+# Unknown asset fallback will return the path passed in when the given
+# asset is not present in the asset pipeline.
+# Rails.application.config.assets.unknown_asset_fallback = false
diff --git a/config/initializers/new_framework_defaults_5_2.rb b/config/initializers/new_framework_defaults_5_2.rb
new file mode 100644
index 0000000..c300f21
--- /dev/null
+++ b/config/initializers/new_framework_defaults_5_2.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+#
+# This file contains migration options to ease your Rails 5.2 upgrade.
+#
+# Once upgraded flip defaults one by one to migrate to the new default.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+
+# Make Active Record use stable #cache_key alongside new #cache_version method.
+# This is needed for recyclable cache keys.
+# Rails.application.config.active_record.cache_versioning = true
+
+# Use AES-256-GCM authenticated encryption for encrypted cookies.
+# Also, embed cookie expiry in signed or encrypted cookies for increased security.
+#
+# This option is not backwards compatible with earlier Rails versions.
+# It's best enabled when your entire app is migrated and stable on 5.2.
+#
+# Existing cookies will be converted on read then written with the new scheme.
+# Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true
+
+# Use AES-256-GCM authenticated encryption as default cipher for encrypting messages
+# instead of AES-256-CBC, when use_authenticated_message_encryption is set to true.
+# Rails.application.config.active_support.use_authenticated_message_encryption = true
+
+# Add default protection from forgery to ActionController::Base instead of in
+# ApplicationController.
+# Rails.application.config.action_controller.default_protect_from_forgery = true
+
+# Store boolean values are in sqlite3 databases as 1 and 0 instead of 't' and
+# 'f' after migrating old data.
+# Rails.application.config.active_record.sqlite3.represent_boolean_as_integer = true
+
+# Use SHA-1 instead of MD5 to generate non-sensitive digests, such as the ETag header.
+# Rails.application.config.active_support.use_sha1_digests = true
+
+# Make `form_with` generate id attributes for any generated HTML tags.
+# Rails.application.config.action_view.form_with_generates_ids = true
diff --git a/config/initializers/new_framework_defaults_6_0.rb b/config/initializers/new_framework_defaults_6_0.rb
new file mode 100644
index 0000000..18a1911
--- /dev/null
+++ b/config/initializers/new_framework_defaults_6_0.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+#
+# This file contains migration options to ease your Rails 6.0 upgrade.
+#
+# Once upgraded flip defaults one by one to migrate to the new default.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+
+# Don't force requests from old versions of IE to be UTF-8 encoded.
+# Rails.application.config.action_view.default_enforce_utf8 = false
+
+# Embed purpose and expiry metadata inside signed and encrypted
+# cookies for increased security.
+#
+# This option is not backwards compatible with earlier Rails versions.
+# It's best enabled when your entire app is migrated and stable on 6.0.
+#
+# Existing cookies will be converted on read then written with the new embed metadata.
+# Rails.application.config.action_dispatch.use_cookies_with_metadata = true
+
+# Change the return value of `ActionDispatch::Response#content_type` to Content-Type header without modification.
+# Rails.application.config.action_dispatch.return_only_media_type_on_content_type = false
+
+# Return false instead of self when enqueuing is aborted from a callback.
+# Rails.application.config.active_job.return_false_on_aborted_enqueue = true
+
+# Send Active Storage analysis and purge jobs to dedicated queues.
+# Rails.application.config.active_storage.queues.analysis = :active_storage_analysis
+# Rails.application.config.active_storage.queues.purge    = :active_storage_purge
+
+# When assigning to a collection of attachments declared via `has_many_attached`, replace existing
+# attachments instead of appending. Use #attach to add new attachments without replacing existing ones.
+# Rails.application.config.active_storage.replace_on_assign_to_many = true
+
+# Use ActionMailer::MailDeliveryJob for sending parameterized and normal mail.
+#
+# The default delivery jobs (ActionMailer::Parameterized::DeliveryJob, ActionMailer::DeliveryJob),
+# will be removed in Rails 6.1. This setting is not backwards compatible with earlier Rails versions.
+# If you send mail in the background, job workers need to have a copy of
+# MailDeliveryJob to ensure all delivery jobs are processed properly.
+# Make sure your entire app is migrated and stable on 6.0 before using this setting.
+# Rails.application.config.action_mailer.delivery_job = "ActionMailer::MailDeliveryJob"
+
+# Enable the same cache key to be reused when the object being cached of type
+# `ActiveRecord::Relation` changes by moving the volatile information (max updated at and count)
+# of the relation's cache key into the cache version to support recycling cache key.
+# Rails.application.config.active_record.collection_cache_versioning = true
diff --git a/config/initializers/new_framework_defaults_6_1.rb b/config/initializers/new_framework_defaults_6_1.rb
new file mode 100644
index 0000000..e2477a4
--- /dev/null
+++ b/config/initializers/new_framework_defaults_6_1.rb
@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+#
+# This file contains migration options to ease your Rails 6.1 upgrade.
+#
+# Once upgraded flip defaults one by one to migrate to the new default.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+
+# Support for inversing belongs_to -> has_many Active Record associations.
+# Rails.application.config.active_record.has_many_inversing = true
+
+# Track Active Storage variants in the database.
+# Rails.application.config.active_storage.track_variants = true
+
+# Apply random variation to the delay when retrying failed jobs.
+# Rails.application.config.active_job.retry_jitter = 0.15
+
+# Stop executing after the first matching `when` clause in `ActiveSupport::TestCase#assert_changes` and `assert_no_changes`.
+# Rails.application.config.active_support.use_assert_matching_results = true
+
+# Specify cookies SameSite protection level: either :none, :lax, or :strict.
+#
+# This change is not backwards compatible with earlier Rails versions.
+# It's best enabled when your entire app is migrated and stable on 6.1.
+# Rails.application.config.action_dispatch.cookies_same_site_protection = :lax
+
+# Generate CSRF tokens that are encoded in URL-safe Base64.
+#
+# This change is not backwards compatible with earlier Rails versions.
+# It's best enabled when your entire app is migrated and stable on 6.1.
+# Rails.application.config.action_controller.urlsafe_csrf_tokens = true
+
+# Specify whether `ActiveSupport::TimeZone.utc_to_local` returns a time with an
+# UTC offset or a UTC time.
+# Rails.application.config.active_support.utc_to_local_returns_utc_offset_times = true
+
+# Change the default HTTP status code to `308` when redirecting non-GET/HEAD
+# requests to HTTPS in `ActionDispatch::SSL` middleware.
+# Rails.application.config.action_dispatch.ssl_default_redirect_status = 308
+
+# Use new connection handling API. For most applications this won't have any
+# effect. For applications using multiple databases, this new API provides
+# support for granular connection swapping.
+# Rails.application.config.active_record.legacy_connection_handling = false
+
+# Make `form_with` generate non-remote forms by default.
+# Rails.application.config.action_view.form_with_generates_remote_forms = false
+
+# Set the default queue name for the analysis job to the queue adapter default.
+# Rails.application.config.active_storage.queues.analysis = nil
+
+# Set the default queue name for the purge job to the queue adapter default.
+# Rails.application.config.active_storage.queues.purge = nil
+
+# Set the default queue name for the incineration job to the queue adapter default.
+# Rails.application.config.action_mailbox.queues.incineration = nil
+
+# Set the default queue name for the routing job to the queue adapter default.
+# Rails.application.config.action_mailbox.queues.routing = nil
+
+# Set the default queue name for the mail deliver job to the queue adapter default.
+# Rails.application.config.action_mailer.deliver_later_queue_name = nil
+
+# Generate channel and job IDs with a random alpha-numeric string instead of integers.
+# If you're upgrading an existing app and need to maintain integer IDs for compatibility,
+# set this to false.
+# Rails.application.config.active_job.use_big_decimal_serializer = true
diff --git a/config/initializers/permissions_policy.rb b/config/initializers/permissions_policy.rb
new file mode 100644
index 0000000..7db3b95
--- /dev/null
+++ b/config/initializers/permissions_policy.rb
@@ -0,0 +1,13 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide HTTP permissions policy. For further
+# information see: https://developers.google.com/web/updates/2018/06/feature-policy
+
+# Rails.application.config.permissions_policy do |policy|
+#   policy.camera      :none
+#   policy.gyroscope   :none
+#   policy.microphone  :none
+#   policy.usb         :none
+#   policy.fullscreen  :self
+#   policy.payment     :self, "https://secure.example.com"
+# end
diff --git a/config/puma.rb b/config/puma.rb
index afdb99a..7859b86 100644
--- a/config/puma.rb
+++ b/config/puma.rb
@@ -1,15 +1,46 @@
-workers Integer(ENV['WEB_CONCURRENCY'] || 2)
-threads_count = Integer(ENV['MAX_THREADS'] || 5)
-threads threads_count, threads_count
+# Puma can serve each request in a thread from an internal thread pool.
+# The `threads` method setting takes two numbers: a minimum and maximum.
+# Any libraries that use thread pools should be configured to match
+# the maximum value specified for Puma. Default is set to 5 threads for minimum
+# and maximum; this matches the default thread size of Active Record.
+#
+max_threads_count = ENV.fetch("MAX_THREADS") { 5 }
+min_threads_count = ENV.fetch("MIN_THREADS") { max_threads_count }
+threads min_threads_count, max_threads_count
 
+# Specifies the `worker_timeout` threshold that Puma will use to wait before
+# terminating a worker in development environments.
+#
+worker_timeout 3600 if ENV.fetch("RAILS_ENV", "development") == "development"
+
+# Specifies the `port` that Puma will listen on to receive requests; default is 3000.
+#
+port ENV.fetch("PORT") { 3000 }
+
+# Specifies the `environment` that Puma will run in.
+#
+environment ENV.fetch("RAILS_ENV") { "development" }
+
+# Specifies the `pidfile` that Puma will use.
+pidfile ENV.fetch("PIDFILE") { "tmp/pids/server.pid" }
+
+# Specifies the number of `workers` to boot in clustered mode.
+# Workers are forked web server processes. If using threads and workers together
+# the concurrency of the application would be max `threads` * `workers`.
+# Workers do not work on JRuby or Windows (both of which do not support
+# processes).
+#
+workers ENV.fetch("WEB_CONCURRENCY") { 2 }
+
+# Use the `preload_app!` method when specifying a `workers` number.
+# This directive tells Puma to first boot the application and load code
+# before forking the application. This takes advantage of Copy On Write
+# process behavior so workers use less memory.
+#
 preload_app!
 
-rackup      DefaultRackup
-port        ENV['PORT']     || 3000
-environment ENV['RACK_ENV'] || 'development'
+# Allow puma to be restarted by `bin/rails restart` command.
+plugin :tmp_restart
 
-on_worker_boot do
-  # Worker specific setup for Rails 4.1+
-  # See: https://devcenter.heroku.com/articles/deploying-rails-applications-with-the-puma-web-server#on-worker-boot
-  ActiveRecord::Base.establish_connection
-end
+# Only use a pidfile when requested
+pidfile ENV["PIDFILE"] if ENV["PIDFILE"]
diff --git a/config/storage.yml b/config/storage.yml
new file mode 100644
index 0000000..4942ab6
--- /dev/null
+++ b/config/storage.yml
@@ -0,0 +1,34 @@
+test:
+  service: Disk
+  root: <%= Rails.root.join("tmp/storage") %>
+
+local:
+  service: Disk
+  root: <%= Rails.root.join("storage") %>
+
+# Use bin/rails credentials:edit to set the AWS secrets (as aws:access_key_id|secret_access_key)
+# amazon:
+#   service: S3
+#   access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %>
+#   secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %>
+#   region: us-east-1
+#   bucket: your_own_bucket-<%= Rails.env %>
+
+# Remember not to checkin your GCS keyfile to a repository
+# google:
+#   service: GCS
+#   project: your_project
+#   credentials: <%= Rails.root.join("path/to/gcs.keyfile") %>
+#   bucket: your_own_bucket-<%= Rails.env %>
+
+# Use bin/rails credentials:edit to set the Azure Storage secret (as azure_storage:storage_access_key)
+# microsoft:
+#   service: AzureStorage
+#   storage_account_name: your_account_name
+#   storage_access_key: <%= Rails.application.credentials.dig(:azure_storage, :storage_access_key) %>
+#   container: your_container_name-<%= Rails.env %>
+
+# mirror:
+#   service: Mirror
+#   primary: local
+#   mirrors: [ amazon, google, microsoft ]
diff --git a/storage/.keep b/storage/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/tmp/.keep b/tmp/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/tmp/pids/.keep b/tmp/pids/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/tmp/storage/.keep b/tmp/storage/.keep
new file mode 100644
index 0000000..e69de29