This seems potentially exploitable -- as a malicious user, I could craft my own POST request with a "score" of 9000, and that single request would give the article thousands of upvotes. (of course in this case I could just sit there and click the button 9000 times anyway, but that's a separate issue) The simplest solution would be to add a validation on the Vote model saying the score can only be -1, 0, or 1.