FYI it looks like you've fixed the update controller (as per the gist), but I can still: * See other peoples rewards (just go to /rewards/whatever-id), not tha

FYI it looks like you've fixed the update controller (as per the gist), but I can still: * See other peoples rewards (just go to /rewards/whatever-id), not that big a deal, unless you want to keep them private. * Go to the edit form of any reward (just go to /rewards/whatever-id/edit), big-deal factor is same as above. * Delete other peoples rewards (inspect the delete link of any reward in chrome, modify the id in the href, then click it), this is somewhat of a big deal. Sorry to whoever had reward with id 4! PITA I know, security doesn't get easier I'm afraid :) EDIT: updated gist to be a little more useful, though you probably worked the required code out for yourself.