presidentbeef/brakeman — pull request #360 by themetric (2013-07-06 15:38:54+00:00)
Title: Check for dangerous model attributes defined in attr_accessible 

During the haste of rapid development with Rails, many developers pack the attr_accessible whitelist with some dangerous attributes that pose a huge security risk. A model relationship with a user belonging to an account with a foreign key `:account_id` for the user that is defined under attr_accessible would allow the user to set the `:account_id` to any account he or she desires and become a member of any account. Other foreign keys and attributes pose similar risks but often the intention is to allow users to rightfully modify foreign keys and so in this check, such keys are reported with low confidence.