- name: profile-field-allowlist
  where: "app/controllers/profiles_controller.rb"
  ensure: >-
    The profile_params method permits only display_name and timezone. It must not permit admin, role, or all parameters with permit! or an empty-hash allowlist.