Earlier quoted context omitted.
It wasn't putting the IP in the log but in the database and along the username and session data, there is an open ticket about that behavior too. Since I'm in Europe/Germany, this kind of data storage would have been a no-go even before the GDPR.
It sounds like you had to remove the Trackable module from Devise - which would indeed be one line of code to change in a Rails app, but quite hard to figure out if you didn't know. However, Devise is a third party gem which is often used with Rails but isn't actually a part of Rails, so can you really blame Rails for this? (And, unless it's for a very specific string, is grepping a codebase that you have no understa…
Grepping can be a successful strategy, esp. when you know what you are looking for and you can search the database column in the code