confirming that validations can attack nested_objects