diff --git a/app/models/direct_debit_detail.rb b/app/models/direct_debit_detail.rb
index 59efae5e..0994f2b4 100644
--- a/app/models/direct_debit_detail.rb
+++ b/app/models/direct_debit_detail.rb
@@ -2,7 +2,11 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class DirectDebitDetail < ApplicationRecord
-  # attr_accessible :iban, :account_holder_name, :bic, :supporter_id, :holder
+  # :iban,
+  # :account_holder_name,
+  # :bic,
+  # :supporter_id,
+  # :holder
 
   has_many :donations
   has_many :charges
diff --git a/app/models/dispute.rb b/app/models/dispute.rb
index aa01fb80..fb919039 100644
--- a/app/models/dispute.rb
+++ b/app/models/dispute.rb
@@ -5,13 +5,13 @@ class Dispute < ApplicationRecord
   Reasons = %i[unrecognized duplicate fraudulent subscription_canceled product_unacceptable product_not_received unrecognized credit_not_processed goods_services_returned_or_refused goods_services_cancelled incorrect_account_details insufficient_funds bank_cannot_process debit_not_authorized general].freeze
 
   Statuses = %i[needs_response under_review won lost lost_and_paid].freeze
-  # TODO
-  # attr_accessible \
-  #   :gross_amount, # int
-  #   :charge_id, :charge,
-  #   :payment_id, :payment,
-  #   :status,
-  #   :reason
+  # :gross_amount, # int
+  # :charge_id,
+  # :charge,
+  # :payment_id,
+  # :payment,
+  # :status,
+  # :reason
 
   belongs_to :charge
   belongs_to :payment
diff --git a/app/models/email_draft.rb b/app/models/email_draft.rb
index ed7047dd..bc4296f3 100644
--- a/app/models/email_draft.rb
+++ b/app/models/email_draft.rb
@@ -2,13 +2,11 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class EmailDraft < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :nonprofit, :nonprofit_id,
-  #   :name,
-  #   :deleted,
-  #   :value,
-  #   :created_at
+  # :nonprofit, :nonprofit_id,
+  # :name,
+  # :deleted,
+  # :value,
+  # :created_at
 
   belongs_to :nonprofit
 
diff --git a/app/models/export.rb b/app/models/export.rb
index c7a3a773..a48e92b9 100644
--- a/app/models/export.rb
+++ b/app/models/export.rb
@@ -2,8 +2,18 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Export < ApplicationRecord
+  # :exception,
+  # :nonprofit,
+  # :status,
+  # :user,
+  # :export_type,
+  # :parameters,
+  # :ended,
+  # :url,
+  # :user_id,
+  # :nonprofit_id
+  
   STATUS = %w[queued started completed failed].freeze
-  # attr_accessible :exception, :nonprofit, :status, :user, :export_type, :parameters, :ended, :url, :user_id, :nonprofit_id
 
   belongs_to :nonprofit
   belongs_to :user
diff --git a/app/models/full_contact_info.rb b/app/models/full_contact_info.rb
index 501fbc92..ee910cb1 100644
--- a/app/models/full_contact_info.rb
+++ b/app/models/full_contact_info.rb
@@ -2,18 +2,16 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactInfo < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :email,
-  #   :full_name,
-  #   :gender,
-  #   :city,
-  #   :county,
-  #   :state_code,
-  #   :country,
-  #   :continent,
-  #   :age,
-  #   :age_range,
+  # :email,
+  # :full_name,
+  # :gender,
+  # :city,
+  # :county,
+  # :state_code,
+  # :country,
+  # :continent,
+  # :age,
+  # :age_range,
   # :location_general,
   # :supporter_id, :supporter,
   # :websites
diff --git a/app/models/full_contact_org.rb b/app/models/full_contact_org.rb
index f457b5bc..a73a708a 100644
--- a/app/models/full_contact_org.rb
+++ b/app/models/full_contact_org.rb
@@ -2,16 +2,14 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactOrg < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :name,
-  #   :is_primary,
-  #   :name,
-  #   :start_date,
-  #   :end_date,
-  #   :title,
-  #   :current,
-  #   :full_contact_info_id, :full_contact_info
+  # :name,
+  # :is_primary,
+  # :name,
+  # :start_date,
+  # :end_date,
+  # :title,
+  # :current,
+  # :full_contact_info_id, :full_contact_info
 
   belongs_to :full_contact_info
 end
diff --git a/app/models/full_contact_photo.rb b/app/models/full_contact_photo.rb
index de86b272..647d542a 100644
--- a/app/models/full_contact_photo.rb
+++ b/app/models/full_contact_photo.rb
@@ -2,13 +2,11 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactPhoto < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :full_contact_info,
-  #   :full_contact_info_id,
-  #   :type_id, # i.e. twitter, linkedin, facebook
-  #   :is_primary, #bool
-  #   :url #string
+  # :full_contact_info,
+  # :full_contact_info_id,
+  # :type_id, # i.e. twitter, linkedin, facebook
+  # :is_primary, #bool
+  # :url #string
 
   belongs_to :full_contact_info
 
diff --git a/app/models/full_contact_social_profile.rb b/app/models/full_contact_social_profile.rb
index 4cdacf24..717829fe 100644
--- a/app/models/full_contact_social_profile.rb
+++ b/app/models/full_contact_social_profile.rb
@@ -2,15 +2,13 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactSocialProfile < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :full_contact_info,
-  #   :full_contact_info_id,
-  #   :type_id, # i.e. twitter, linkedin, facebook
-  #   :username, #string
-  #   :uid, # string
-  #   :bio, #string
-  #   :url #string
+  # :full_contact_info,
+  # :full_contact_info_id,
+  # :type_id, # i.e. twitter, linkedin, facebook
+  # :username, #string
+  # :uid, # string
+  # :bio, #string
+  # :url #string
 
   belongs_to :full_contact_info
 
diff --git a/app/models/full_contact_topic.rb b/app/models/full_contact_topic.rb
index 98f6fe37..952195a3 100644
--- a/app/models/full_contact_topic.rb
+++ b/app/models/full_contact_topic.rb
@@ -2,11 +2,9 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactTopic < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :provider,
-  #   :value,
-  #   :full_contact_info_id, :full_contact_info
+  # :provider,
+  # :value,
+  # :full_contact_info_id, :full_contact_info
 
   belongs_to :full_contact_info
 end
diff --git a/app/models/image_attachment.rb b/app/models/image_attachment.rb
index ce97e086..002a05d9 100644
--- a/app/models/image_attachment.rb
+++ b/app/models/image_attachment.rb
@@ -2,7 +2,8 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class ImageAttachment < ApplicationRecord
-  attr_accessible :parent_id, :file
+  # :parent_id,
+  # :file
   mount_uploader :file, ImageAttachmentUploader
 
   # not sure if poly parent is used on this model, as all values are nil in db
diff --git a/app/models/miscellaneous_np_info.rb b/app/models/miscellaneous_np_info.rb
index 6a15fee8..3bd32dbb 100644
--- a/app/models/miscellaneous_np_info.rb
+++ b/app/models/miscellaneous_np_info.rb
@@ -2,8 +2,6 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class MiscellaneousNpInfo < ApplicationRecord
-  # TODO
-  # attr_accessible \
   # :donate_again_url,
   # :change_amount_message
 
diff --git a/app/models/nonprofit_account.rb b/app/models/nonprofit_account.rb
index 5410c269..c30938dd 100644
--- a/app/models/nonprofit_account.rb
+++ b/app/models/nonprofit_account.rb
@@ -2,10 +2,8 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class NonprofitAccount < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :stripe_account_id, #str
-  #   :nonprofit, :nonprofit_id #int
+  # :stripe_account_id, #str
+  # :nonprofit, :nonprofit_id #int
 
   belongs_to :nonprofit
 
diff --git a/app/models/offsite_payment.rb b/app/models/offsite_payment.rb
index abdbcd37..12f0606b 100644
--- a/app/models/offsite_payment.rb
+++ b/app/models/offsite_payment.rb
@@ -2,7 +2,10 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class OffsitePayment < ApplicationRecord
-  # attr_accessible :gross_amount, :kind, :date, :check_number
+# :gross_amount,
+# :kind,
+# :date,
+# :check_number
   belongs_to :payment, dependent: :destroy
   belongs_to :donation
   belongs_to :nonprofit
diff --git a/app/models/payment.rb b/app/models/payment.rb
index f355d8f2..17214de7 100644
--- a/app/models/payment.rb
+++ b/app/models/payment.rb
@@ -6,14 +6,12 @@
 # If connected to an offsite_payment, this is money the nonprofit is recording for convenience.
 
 class Payment < ApplicationRecord
-  # TODO
-  #   attr_accessible \
-  #     :towards,
-  #     :gross_amount,
-  #     :refund_total,
-  #     :fee_total,
-  #     :kind,
-  #     :date
+  # :towards,
+  # :gross_amount,
+  # :refund_total,
+  # :fee_total,
+  # :kind,
+  # :date
 
   belongs_to :supporter
   belongs_to :nonprofit
diff --git a/app/models/payment_payout.rb b/app/models/payment_payout.rb
index f5dc5354..c817f63e 100644
--- a/app/models/payment_payout.rb
+++ b/app/models/payment_payout.rb
@@ -14,12 +14,10 @@
 # since our fees will continue to change as our transaction volume increases
 
 class PaymentPayout < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :payment_id, :payment,
-  #   :charge_id, :charge, # deprecated
-  #   :payout_id, :payout,
-  #   :total_fees # int (cents)
+  # :payment_id, :payment,
+  # :charge_id, :charge, # deprecated
+  # :payout_id, :payout,
+  # :total_fees # int (cents)
 
   belongs_to :charge # deprecated
   belongs_to :payment
diff --git a/app/models/payout.rb b/app/models/payout.rb
index 26222453..e5911cc6 100644
--- a/app/models/payout.rb
+++ b/app/models/payout.rb
@@ -7,21 +7,19 @@
 # These are tied to Stripe transfers
 
 class Payout < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :scheduled, # bool (whether this was made automatically at the beginning of the month)
-  #   :count, # int (number of donations for this payout)
-  #   :ach_fee, # int (in cents, the total fee for the payout itself)
-  #   :gross_amount, # int (in cents, total amount before fees)
-  #   :fee_total, # int (in cents, total amount of fees)
-  #   :net_amount, # int (in cents, total amount after fees for this payout)
-  #   :email, # str (cache of user email who issued this)
-  #   :user_ip, # str (ip address of the user who made this payout)
-  #   :status, # str ('pending', 'paid', 'canceled', or 'failed')
-  #   :failure_message, # str
-  #   :bank_name, # str: cache of the nonprofit's bank name
-  #   :stripe_transfer_id, # str
-  #   :nonprofit_id, :nonprofit
+  # :scheduled, # bool (whether this was made automatically at the beginning of the month)
+  # :count, # int (number of donations for this payout)
+  # :ach_fee, # int (in cents, the total fee for the payout itself)
+  # :gross_amount, # int (in cents, total amount before fees)
+  # :fee_total, # int (in cents, total amount of fees)
+  # :net_amount, # int (in cents, total amount after fees for this payout)
+  # :email, # str (cache of user email who issued this)
+  # :user_ip, # str (ip address of the user who made this payout)
+  # :status, # str ('pending', 'paid', 'canceled', or 'failed')
+  # :failure_message, # str
+  # :bank_name, # str: cache of the nonprofit's bank name
+  # :stripe_transfer_id, # str
+  # :nonprofit_id, :nonprofit
 
   belongs_to :nonprofit
   has_one    :bank_account, through: :nonprofit
diff --git a/app/models/refund.rb b/app/models/refund.rb
index e315552b..faed9dff 100644
--- a/app/models/refund.rb
+++ b/app/models/refund.rb
@@ -3,18 +3,15 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Refund < ApplicationRecord
   Reasons = %i[duplicate fraudulent requested_by_customer].freeze
-
-  # TODO:
-  # attr_accessible \
-  #   :amount, # int
-  #   :comment, # text
-  #   :reason, # str ('duplicate', 'fraudulent', or 'requested_by_customer')
-  #   :stripe_refund_id,
-  #   :disbursed, # boolean (whether this refund has been counted in a payout)
-  #   :failure_message, # str (accessor for storing the Stripe error message)
-  #   :user_id, :user, # user who made this refund
-  #   :payment_id, :payment, # negative payment that records this refund
-  #   :charge_id, :charge
+  # :amount, # int
+  # :comment, # text
+  # :reason, # str ('duplicate', 'fraudulent', or 'requested_by_customer')
+  # :stripe_refund_id,
+  # :disbursed, # boolean (whether this refund has been counted in a payout)
+  # :failure_message, # str (accessor for storing the Stripe error message)
+  # :user_id, :user, # user who made this refund
+  # :payment_id, :payment, # negative payment that records this refund
+  # :charge_id, :charge
 
   attr_accessor :failure_message
 
diff --git a/app/models/source_token.rb b/app/models/source_token.rb
index 7e9ba7dc..75e02055 100644
--- a/app/models/source_token.rb
+++ b/app/models/source_token.rb
@@ -3,7 +3,10 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class SourceToken < ApplicationRecord
   self.primary_key = :token
-  # attr_accessible :expiration, :token, :max_uses, :total_uses
+  # :expiration,
+  # :token,
+  # :max_uses,
+  # :total_uses
   belongs_to :tokenizable, polymorphic: true
   belongs_to :event
 end
diff --git a/app/models/supporter.rb b/app/models/supporter.rb
index cfaf71de..8b115218 100644
--- a/app/models/supporter.rb
+++ b/app/models/supporter.rb
@@ -2,34 +2,32 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Supporter < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :search_vectors,
-  #   :profile_id, :profile,
-  #   :nonprofit_id, :nonprofit,
-  #   :full_contact_info, :full_contact_info_id,
-  #   :import_id, :import,
-  #   :name,
-  #   :first_name,
-  #   :last_name,
-  #   :email,
-  #   :address,
-  #   :city,
-  #   :state_code,
-  #   :country,
-  #   :phone,
-  #   :organization,
-  #   :latitude,
-  #   :locale,
-  #   :longitude,
-  #   :zip_code,
-  #   :total_raised,
-  #   :notes,
-  #   :fields,
-  #   :anonymous,
-  #   :deleted, # bool (flag for soft delete)
-  #   :email_unsubscribe_uuid, #string
-  #   :is_unsubscribed_from_emails #bool
+  # :search_vectors,
+  # :profile_id, :profile,
+  # :nonprofit_id, :nonprofit,
+  # :full_contact_info, :full_contact_info_id,
+  # :import_id, :import,
+  # :name,
+  # :first_name,
+  # :last_name,
+  # :email,
+  # :address,
+  # :city,
+  # :state_code,
+  # :country,
+  # :phone,
+  # :organization,
+  # :latitude,
+  # :locale,
+  # :longitude,
+  # :zip_code,
+  # :total_raised,
+  # :notes,
+  # :fields,
+  # :anonymous,
+  # :deleted, # bool (flag for soft delete)
+  # :email_unsubscribe_uuid, #string
+  # :is_unsubscribed_from_emails #bool
 
   belongs_to :profile
   belongs_to :nonprofit
diff --git a/app/models/supporter_email.rb b/app/models/supporter_email.rb
index 13864dbd..340afa3a 100644
--- a/app/models/supporter_email.rb
+++ b/app/models/supporter_email.rb
@@ -2,16 +2,14 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class SupporterEmail < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :to,
-  #   :from,
-  #   :subject,
-  #   :body,
-  #   :recipient_count,
-  #   :supporter_id, :supporter,
-  #   :nonprofit_id,
-  #   :gmail_thread_id
+  # :to,
+  # :from,
+  # :subject,
+  # :body,
+  # :recipient_count,
+  # :supporter_id, :supporter,
+  # :nonprofit_id,
+  # :gmail_thread_id
 
   belongs_to :supporter
   validates_presence_of :nonprofit_id
diff --git a/app/models/supporter_note.rb b/app/models/supporter_note.rb
index 3c827690..cbeeaea9 100644
--- a/app/models/supporter_note.rb
+++ b/app/models/supporter_note.rb
@@ -2,10 +2,8 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class SupporterNote < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :content,
-  #   :supporter_id, :supporter
+  # :content,
+  # :supporter_id, :supporter
 
   belongs_to :supporter
   has_many :activities, as: :attachment, dependent: :destroy
diff --git a/app/models/tag_join.rb b/app/models/tag_join.rb
index d6ca78ca..9cdbb154 100644
--- a/app/models/tag_join.rb
+++ b/app/models/tag_join.rb
@@ -2,10 +2,8 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class TagJoin < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :supporter, :supporter_id,
-  #   :tag_master, :tag_master_id
+  # :supporter, :supporter_id,
+  # :tag_master, :tag_master_id
 
   validates :tag_master, presence: true
 
diff --git a/app/models/tag_master.rb b/app/models/tag_master.rb
index b613275d..efca9eea 100644
--- a/app/models/tag_master.rb
+++ b/app/models/tag_master.rb
@@ -2,12 +2,10 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class TagMaster < ApplicationRecord
-  # TODO:
-  # attr_accessible \
-  #   :nonprofit, :nonprofit_id,
-  #   :name,
-  #   :deleted,
-  #   :created_at
+  # :nonprofit, :nonprofit_id,
+  # :name,
+  # :deleted,
+  # :created_at
 
   validates :name, presence: true
   validate :no_dupes, on: :create
diff --git a/app/models/tracking.rb b/app/models/tracking.rb
index afb3cf75..50485c58 100644
--- a/app/models/tracking.rb
+++ b/app/models/tracking.rb
@@ -2,7 +2,10 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Tracking < ApplicationRecord
-  # attr_accessible :utm_campaign, :utm_content, :utm_medium, :utm_source
+  # :utm_campaign,
+  # :utm_content,
+  # :utm_medium,
+  # :utm_source
 
   belongs_to :donation
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 7a9af591..b32cb218 100755
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -2,29 +2,27 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class User < ApplicationRecord
-  # TODO:
-  # attr_accessible \
-  #   :email, # str: balidated with Devise
-  #   :password, # str: hashed with bcrypt
+  # :email, # str: balidated with Devise
+  # :password, # str: hashed with bcrypt
   # :phone, # str
-  #   :location,
-  #   :city,
-  #   :state_code,
-  #   :password_confirmation, # accessor: used on registration
-  #   :remember_me, # bool: don't sign user out for a while
-  #   :provider, # str: OAuth provider
-  #   :uid, # str: OAuth user ID
-  #   :pending_password, # bool: User registered with oauth and did not set a password
-  #   :name, # str: created with oauth
-  #   :auto_generated, # bool: flag whether a password was auto-generated for this account
-  #   :referer, # str: ID of the user who referred this account
-  #   :latitude,
-  #   :longitude,
-  #   :reset_password_token,
-  #   :reset_password_sent_at,
-  #   :picture, # str: url for fb or twitter pic
-  #   :current_password, # accessor: for updating pass
-  #   :profile_attributes,
+  # :location,
+  # :city,
+  # :state_code,
+  # :password_confirmation, # accessor: used on registration
+  # :remember_me, # bool: don't sign user out for a while
+  # :provider, # str: OAuth provider
+  # :uid, # str: OAuth user ID
+  # :pending_password, # bool: User registered with oauth and did not set a password
+  # :name, # str: created with oauth
+  # :auto_generated, # bool: flag whether a password was auto-generated for this account
+  # :referer, # str: ID of the user who referred this account
+  # :latitude,
+  # :longitude,
+  # :reset_password_token,
+  # :reset_password_sent_at,
+  # :picture, # str: url for fb or twitter pic
+  # :current_password, # accessor: for updating pass
+  # :profile_attributes,
   # :phone
 
   geocoded_by :location