Prevent non-authors from viewing valuation comments

app/controllers/comments_controller.rb

@@ -21,8 +21,12 @@ class CommentsController < ApplicationController
 
   def show
     @comment = Comment.find(params[:id])
+    if @comment.valuation && @comment.author != current_user
+      raise ActiveRecord::RecordNotFound
+    else
       set_comment_flags(@comment.subtree)
     end
+  end
 
   def vote
     @comment.vote_by(voter: current_user, vote: params[:value])