You might have thought so, but you'd be pleasantly surprised. Strong parameters verifies the structure of nested parameters explicitly.

```ruby
[1] pry(#<IdeasController>)> params
=> {"user"=>{"email"=>{"$regex"=>"c"}}, "action"=>"index", "controller"=>"ideas"}
[2] pry(#<IdeasController>)> params.permitted?
=> false
[3] pry(#<IdeasController>)> params[:user].permitted?
=> false
[4] pry(#<IdeasController>)> params.permit(:user)
Unpermitted parameters: user
=> {}
[5] pry(#<IdeasController>)>
[6] pry(#<IdeasController>)> params.permit(user: :email)
Unpermitted parameters: email
=> {"user"=>{}}
[7] pry(#<IdeasController>)> params.permit(user: {email: "$regex"})
=> {"user"=>{"email"=>{"$regex"=>"c"}}}
[8] pry(#<IdeasController>)> params.permit(user: {email: "$regex"})[:user][:email].permitted?
=> true
```