diff --git a/app/models/comment.rb b/app/models/comment.rb
index 426987cb1..72045e801 100644
--- a/app/models/comment.rb
+++ b/app/models/comment.rb
@@ -13,6 +13,7 @@ class Comment < ActiveRecord::Base
   serialize :data
 
   validates :body, :user, :commentable_id, :commentable_type, :project_id, presence: true
+  validates :body, length: { maximum: 10000 }
 
   scope :for_commit, ->(c) { where(commentable_id: c.id.hex, commentable_type: c.class) }
   default_scope { order(:created_at) }
diff --git a/app/models/group.rb b/app/models/group.rb
index f507d8f7e..6b7074b23 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -15,7 +15,11 @@ class Group < Avatar
   has_many :own_platforms, as: :owner, class_name: 'Platform', dependent: :destroy
 
   validates :owner, presence: true
-  validates :uname, presence: true, uniqueness: {case_sensitive: false}, format: {with: /\A[a-z0-9_]+\z/}, reserved_name: true
+  validates :uname, presence: true,
+            uniqueness: {case_sensitive: false},
+            format: {with: /\A[a-z0-9_]+\z/},
+            reserved_name: true,
+            length: { maximum: 100 }
   validate { errors.add(:uname, :taken) if User.by_uname(uname).present? }
 
   scope :opened, -> { all }
diff --git a/app/models/issue.rb b/app/models/issue.rb
index 7ea86a7b8..db3331933 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -36,6 +36,8 @@ class Issue < ActiveRecord::Base
   has_one :pull_request#, dependent: :destroy
 
   validates :title, :body, :project, presence: true
+  validates :title, length: { maximum: 100 }
+  validates :body, length: { maximum: 10000 }
 
   after_create :set_serial_id
   after_create :subscribe_users
diff --git a/app/models/platform.rb b/app/models/platform.rb
index 7ab711098..ccfe45d4d 100644
--- a/app/models/platform.rb
+++ b/app/models/platform.rb
@@ -42,7 +42,8 @@ class Platform < ActiveRecord::Base
   has_many :mass_builds, foreign_key: :save_to_platform_id
 
   validates :description,
-    presence: true
+    presence: true,
+    length: { maximum: 10000 }
 
   validates :visibility,
     presence:   true,
@@ -59,7 +60,8 @@ class Platform < ActiveRecord::Base
   validates :name,
     uniqueness: { case_sensitive: false },
     presence:   true,
-    format:     { with: /\A#{NAME_PATTERN}\z/ }
+    format:     { with: /\A#{NAME_PATTERN}\z/ },
+    length: { maximum: 100 }
 
   validates :distrib_type,
     presence:   true,
diff --git a/app/models/product.rb b/app/models/product.rb
index d8d5da9c8..69dc431f7 100644
--- a/app/models/product.rb
+++ b/app/models/product.rb
@@ -7,7 +7,10 @@ class Product < ActiveRecord::Base
   belongs_to :project
   has_many :product_build_lists, dependent: :destroy
 
-  validates :name, presence: true, uniqueness: { scope: :platform_id }
+  validates :name, presence: true,
+            uniqueness: { scope: :platform_id },
+            length: { maximum: 100 }
+
   validates :project, presence: true
   validates :main_script, :params, length: { maximum: 255 }
 
diff --git a/app/models/project.rb b/app/models/project.rb
index 949245b8e..725d9597d 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -40,7 +40,8 @@ class Project < ActiveRecord::Base
   validates :name, uniqueness: { scope: [:owner_id, :owner_type], case_sensitive: false },
                    presence: true,
                    format: { with: /\A#{NAME_REGEXP.source}\z/,
-                             message: I18n.t("activerecord.errors.project.uname") }
+                             message: I18n.t("activerecord.errors.project.uname") },
+                   length: { maximum: 100 }
   validates :maintainer, presence: true, unless: :new_record?
   validates :url, presence: true, format: { with: /\Ahttps?:\/\/[\S]+\z/ }, if: :mass_import
   validates :add_to_repository, presence: true, if: :mass_import
diff --git a/app/models/repository.rb b/app/models/repository.rb
index c337f9750..ab220923a 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -21,9 +21,14 @@ class Repository < ActiveRecord::Base
 
   has_many :build_lists, foreign_key: :save_to_repository_id, dependent: :destroy
 
-  validates :description, presence: true
-  validates :name, uniqueness: { scope: :platform_id, case_sensitive: false }, presence: true,
-            format: { with: /\A[a-z0-9_\-]+\z/ }
+  validates :description, presence: true,
+            length: { maximum: 100 }
+
+  validates :name, uniqueness: { scope: :platform_id, case_sensitive: false },
+            presence: true,
+            format: { with: /\A[a-z0-9_\-]+\z/ },
+            length: { maximum: 100 }
+
   validates :publish_builds_only_from_branch, length: { maximum: 255 }
 
   scope :recent, -> { order(:name) }
diff --git a/app/models/token.rb b/app/models/token.rb
index 5525bd774..ff5f810db 100644
--- a/app/models/token.rb
+++ b/app/models/token.rb
@@ -5,6 +5,7 @@ class Token < ActiveRecord::Base
 
   validates :creator_id, :subject_id, :subject_type, presence: true
   validates :authentication_token, presence: true, uniqueness: { case_sensitive: true }
+  validates :description, length: { maximum: 1000 }
 
   default_scope { order(created_at: :desc) }
   scope :by_active, -> { where(status: 'active') }
diff --git a/app/models/user.rb b/app/models/user.rb
index e0913a290..bb7e046e2 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -44,8 +44,13 @@ class User < Avatar
   has_many :key_pairs
   has_many :ssh_keys, dependent: :destroy
 
-  validates :uname, presence: true, uniqueness: { case_sensitive: false },
-            format: { with: /\A#{NAME_REGEXP.source}\z/ }, reserved_name: true
+  validates :uname, presence: true,
+            uniqueness: { case_sensitive: false },
+            format: { with: /\A#{NAME_REGEXP.source}\z/ },
+            reserved_name: true,
+            length: { maximum: 30 }
+  validates :name, length: { maximum: 100 }
+
   validate { errors.add(:uname, :taken) if Group.by_uname(uname).present? }
   validates :role, inclusion: { in: EXTENDED_ROLES }, allow_blank: true
   validates :language, inclusion: { in: LANGUAGES }, allow_blank: true