Every major ORM and web framework has a mechanism to protect against mass assignment. Use it.

• Ruby on Rails: Use params.require(:key).permit(:field1, :field2) — never update_attributes(params[:key]) directly.

• Django REST Framework: Explicitly list fields in the serializer's fields or use read_only_fields.

• Laravel: Use the $fillable property on models to whitelist assignable fields — or use $guarded carefully.

• ASP.NET MVC: Use [Bind(Include="field1,field2")] on model parameters.

• Spring: Use @JsonIgnore on sensitive fields and @DataBoundConstructor carefully.

The GitHub breach happened because update_attributes(params[:public_key]) bound all params including user_id. The fix was one line: params.require(:public_key).permit(:key). The vulnerability existed because auto-binding was used without a field permit list.