[c3]

It's only a security problem if you're using the Model#where form. If you're doing Model#all or #each or whatever, you're fine.

[omgsean]

Are you sure? That's what I thought at first, but was the .where form even available in versions before 3.0?