[Polylactic_acid]

The unscoped find issue is fairly easily solved by using devise's current_user in combination with something like cancancan. Let them send anything as a param but have the controller blow up if the user doesn't have permission to access it.

I suspect an insane number of websites are validated only by the frontend and can be exploited like this.

[atom_enger]

You'd suspect right :) I've had a huge number of bounties from this as a result of finding the pattern first on Reverb.

[greenie_beans]

Can't this be solved with scoping via the pundit gem, as well?