Here's the security vulnerability that prompted the change: [CVE-2013-0155](https://groups.google.com/forum/#!topic/rubyonrails-security/t1WFuuQyavI). I don't think it really affects us since we use #readable in our index actions. If we do decide on patching deep_munge, we just need to make sure going forward (i.e. the new RBAC code) that we filter by permissions in our index actions.

I'll try looking at patching strong_params and try to come up with a patch.