It's only a security problem if you're using the Model#where form. If you're doing Model#all or #each or whatever, you're fine.