We included a spec in our rails app that inspects all AR models and errors if any don't specify any attr_accessible (with a whitelist of models to ignore). This catches anything included by plugins too, which can be helpful.

https://github.com/instructure/canvas-lms/blob/9b52a51b6a37e...