diff --git a/app/controllers/projects/git_hooks_controller.rb b/app/controllers/projects/git_hooks_controller.rb
index c4eb39b53c..c774b4233a 100644
--- a/app/controllers/projects/git_hooks_controller.rb
+++ b/app/controllers/projects/git_hooks_controller.rb
@@ -14,7 +14,7 @@ class Projects::GitHooksController < Projects::ApplicationController
 
   def update
     @pre_receive_hook = project.git_hook
-    @pre_receive_hook.update_attributes(params[:git_hook])
+    @pre_receive_hook.update_attributes(git_hook_params)
 
     if @pre_receive_hook.valid?
       redirect_to project_git_hooks_path(@project)
@@ -22,4 +22,11 @@ class Projects::GitHooksController < Projects::ApplicationController
       render :index
     end
   end
+
+  private
+
+  # Only allow a trusted parameter "white list" through.
+  def git_hook_params
+    params.require(:git_hook).permit(:deny_delete_tag, :delete_branch_regex, :commit_message_regex, :force_push_regex)
+  end
 end
diff --git a/app/controllers/projects/services_controller.rb b/app/controllers/projects/services_controller.rb
index b143dec3a9..0a9731a6a7 100644
--- a/app/controllers/projects/services_controller.rb
+++ b/app/controllers/projects/services_controller.rb
@@ -40,7 +40,7 @@ class Projects::ServicesController < Projects::ApplicationController
   def service_params
     params.require(:service).permit(
       :title, :token, :type, :active, :api_key, :subdomain,
-      :room, :recipients, :project_url
+      :room, :recipients, :project_url, :username, :password, :api_version
     )
   end
 end
diff --git a/app/models/appearance.rb b/app/models/appearance.rb
index 05809f4a07..5d8edf4990 100644
--- a/app/models/appearance.rb
+++ b/app/models/appearance.rb
@@ -1,6 +1,4 @@
 class Appearance < ActiveRecord::Base
-  attr_accessible :title, :description, :logo
-
   validates :title, presence: true
   validates :description, presence: true
   validates :logo, file_size: { maximum: 1000.kilobytes.to_i }
diff --git a/app/models/git_hook.rb b/app/models/git_hook.rb
index 59a405a0b9..f45f57aa99 100644
--- a/app/models/git_hook.rb
+++ b/app/models/git_hook.rb
@@ -1,6 +1,4 @@
 class GitHook < ActiveRecord::Base
-  attr_accessible :deny_delete_tag, :delete_branch_regex, :commit_message_regex, :force_push_regex
-
   belongs_to :project
   validates :project, presence: true
 
diff --git a/app/models/project_services/jenkins_service.rb b/app/models/project_services/jenkins_service.rb
index 44b34a405b..2fc8b62c34 100644
--- a/app/models/project_services/jenkins_service.rb
+++ b/app/models/project_services/jenkins_service.rb
@@ -18,8 +18,6 @@
 #
 
 class JenkinsService < CiService
-  attr_accessible :project_url
-
   validates :project_url, presence: true, if: :activated?
 
   delegate :execute, to: :service_hook, prefix: nil
diff --git a/app/models/project_services/jira_service.rb b/app/models/project_services/jira_service.rb
index c1ae4eb250..96faea5536 100644
--- a/app/models/project_services/jira_service.rb
+++ b/app/models/project_services/jira_service.rb
@@ -20,9 +20,7 @@
 #  api_version    :string(255)
 
 class JiraService < Service
-
   include HTTParty
-  attr_accessible :project_url, :username, :password, :api_version
 
   validates :username, :password, presence: true, if: :activated?
   before_validation :set_api_version