use strong params:
```ruby
@update = @project.updates.new(update_params)
...
def update_params
  params.require(:update).permit(...).merge!(...)
end
```