Modify Rails view binding to allow values to be explicitly exposed to the views and telling the instance variables to GTFO.

application_controller.rb

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
    
  def render(*args)
    options = args.extract_options!
    options[:locals] ||= @_exposed
    super *args, options
  end

  def view_assigns
    {}
  end

private 

  def expose(name, value)
    (@_exposed ||= {})[name] = value
  end
end

users_controller.rb

class UsersController < ApplicationController
  def show
    expose :user, User.find(params[:id])
  end
end