I'd say go with the thoughtbot/guides guideline for this one. Likewise, I don't feel super strongly about it but I do like the consistency of whitelists in routes, strong parameters, etc. Exposing just what we need, defining the API, that kind of thing. And if we have a thoughtbot/guides guideline, might as well follow it until we change it via discussion on that repo.