You can secure your model’s important attributes from bulk updates using attr_accessible or @attr_protected in the model declaration. And write tests about it. Always!
ex:-
class User << ActiveRecord::Base
    attr_accessible :username, :email
    #or 
    attr_protected :purchased_credits 
    #check rails documentation for more info
.......
end

Ex. of attr_accessible
class Customer < ActiveRecord::Base
    attr_accessible :name, :nickname
  end

  customer = Customer.new(:name => "David", :nickname => "Dave", :credit_rating => "Excellent")
  customer.credit_rating # => nil
  customer.attributes = { :name => "Jolly fellow", :credit_rating => "Superb" }
  customer.credit_rating # => nil

  customer.credit_rating = "Average"
  customer.credit_rating # => "Average"

Ex. of attr_protected
class Customer < ActiveRecord::Base
    attr_protected :credit_rating
  end

  customer = Customer.new("name" => David, "credit_rating" => "Excellent")
  customer.credit_rating # => nil
  customer.attributes = { "description" => "Jolly fellow", "credit_rating" => "Superb" }
  customer.credit_rating # => nil

  customer.credit_rating = "Average"
  customer.credit_rating # => "Average"