* why use protected_attributes in an new Rails 4 project? I'm curious what motivated this decision.
* if you're destroying records, you'll want to look into using the :dependent option to has_many to make sure you clean things up. However, you may want to carefully consider where in the app "deletion" actually makes sense; anything that winds up in an accounting system probably shouldn't be deletable at all.
* get the tests running. The version on Github has a controller test for "ZusersController" which doesn't appear to exist in the application...
* a minor thing, but it'll drive future contributors crazy: hard tabs vs. soft tabs. Ruby code is usually two-space soft-tabs, but even if you don't agree with that at least be consistent. There are files on GH that are a riot of mixed tabs (configurations_controller.rb is a notable example) and nobody's got time for that.
I'm not the best at catching replies on HN, but ping me on Github (same username) if you want to discuss further.