Return 403 by default for Pundit errors

config/application.rb

@@ -26,6 +26,8 @@ module Justask
     config.i18n.fallbacks = [I18n.default_locale]
     config.i18n.enforce_available_locales = false
 
+    config.action_dispatch.rescue_responses["Pundit::NotAuthorizedError"] = :forbidden
+
     config.after_initialize do
       Dir.glob Rails.root.join('config/late_initializers/*.rb') do |f|
         require f