So it only the only the dynamic finders (find_by_) that have the vulnerability, not Model.find(params[:id])?