Will It Vibe?Mass assignment without strong params
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
params is passed directly into create/new/update/assign_attributes with no .permit call in the same statement, so any attribute the client names in the request body is assigned, including ones no form or API contract ever exposed.
Why it matters
Mass assignment lets a client set any attribute a model has, not just the ones a form displays, by adding extra fields to the request body. Rails added strong parameters specifically to close this hole after real incidents where an extra field in a POST body flipped an admin flag or changed an owner id. Skipping .permit brings that risk back regardless of how careful the visible form is.
How to fix it
Build an explicit allowlist with params.require(:model).permit(:field_one, :field_two, ...) and pass that result into create/new/update instead of the raw params hash or sub-hash. Keep the allowlist next to the action, typically a private method named after the resource, and add a field to it only when a real feature needs the client to set it.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo