If I'm reading this correctly, we're converting user input `params[:category]` to a symbol and then using that to invoke a method.

This has two problems, which I expect you can see now that I've pointed it out:
1) a vulnerability where a user sends random `category` values, which are converted to symbols and hence never garbage collected, causing us to run out of memory
2) a potential vulnerability where they send a `category` that maps to a method we didn't intend them to execute (eg `delete`)