diff --git a/.circleci/config.yml b/.circleci/config.yml
index 871c3d959..f8a62f6be 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -57,6 +57,9 @@ jobs:
       - run:
           name: Run rubocop
           command: bundle exec rubocop -R
+      - run:
+          name: Run brakeman
+          command: bundle exec brakeman -z
       - run:
           name: Run haml-lint
           command: bundle exec haml-lint app/views/
diff --git a/Gemfile b/Gemfile
index 839c2fe48..c6ed17aae 100644
--- a/Gemfile
+++ b/Gemfile
@@ -126,6 +126,7 @@ group :test do
 end
 
 group :development do
+  gem 'brakeman', require: false
   # Access an IRB console on exception pages or by using <%= console %> in views
   gem 'web-console'
   gem 'rack-handlers'
diff --git a/Gemfile.lock b/Gemfile.lock
index 8c2ca041e..1f6a4eee2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -91,6 +91,7 @@ GEM
       sass (>= 3.3.4)
     bootstrap-wysihtml5-rails (0.3.3.8)
       railties (>= 3.0)
+    brakeman (3.7.0)
     browser (2.3.0)
     builder (3.2.3)
     byebug (9.0.6)
@@ -682,6 +683,7 @@ DEPENDENCIES
   bootstrap-datepicker-rails
   bootstrap-sass (~> 3.3.5)
   bootstrap-wysihtml5-rails (~> 0.3.3.8)
+  brakeman
   browser
   byebug
   capybara
diff --git a/README.md b/README.md
index 02e3a3db2..4c97771a0 100644
--- a/README.md
+++ b/README.md
@@ -73,7 +73,8 @@ Pour exécuter les tests de l'application, plusieurs possibilités :
 
 ## Linting
 
-- Faire tourner RuboCop : `bundle exec rubocop`
+- Faire tourner RuboCop : `bundle exec rubocop -R`
+- Faire tourner Brakeman : `bundle exec brakeman -z`
 - Linter les fichiers HAML : `bundle exec haml-lint app/views/`
 - Linter les fichiers SCSS : `bundle exec scss-lint app/assets/stylesheets/`
 
diff --git a/app/controllers/admin/accompagnateurs_controller.rb b/app/controllers/admin/accompagnateurs_controller.rb
index 6f6314851..16fb8e4da 100644
--- a/app/controllers/admin/accompagnateurs_controller.rb
+++ b/app/controllers/admin/accompagnateurs_controller.rb
@@ -12,7 +12,7 @@ class Admin::AccompagnateursController < AdminController
       array: true
 
     not_assign_scope = current_administrateur.gestionnaires.where.not(id: assign_scope.ids)
-    not_assign_scope = not_assign_scope.where("email LIKE '%#{params[:filter]}%'") if params[:filter]
+    not_assign_scope = not_assign_scope.where("email LIKE ?", "%#{params[:filter]}%") if params[:filter]
 
     @accompagnateurs_not_assign = smart_listing_create :accompagnateurs_not_assign,
       not_assign_scope,
diff --git a/app/controllers/admin/procedures_controller.rb b/app/controllers/admin/procedures_controller.rb
index e85e6c2b4..324543998 100644
--- a/app/controllers/admin/procedures_controller.rb
+++ b/app/controllers/admin/procedures_controller.rb
@@ -43,7 +43,7 @@ class Admin::ProceduresController < AdminController
   end
 
   def hide
-    procedure = Procedure.find(params[:id])
+    procedure = current_administrateur.procedures.find(params[:id])
     procedure.hide!
 
     flash.notice = "Procédure supprimée, en cas d'erreur contactez nous : contact@tps.apientreprise.fr"
@@ -51,7 +51,7 @@ class Admin::ProceduresController < AdminController
   end
 
   def destroy
-    procedure = Procedure.find(params[:id])
+    procedure = current_administrateur.procedures.find(params[:id])
 
     return render json: {}, status: 401 if procedure.publiee_ou_archivee?
 
@@ -192,7 +192,7 @@ class Admin::ProceduresController < AdminController
                      .joins(', procedures')
                      .where("procedures.id = procedure_paths.procedure_id")
                      .where("procedures.archived_at" => nil)
-                     .where("path LIKE '%#{params[:request]}%'")
+                     .where("path LIKE ?", "%#{params[:request]}%")
                      .pluck(:path, :administrateur_id)
                      .inject([]) {
                |acc, value| acc.push({label: value.first, mine: value.second == current_administrateur.id})
diff --git a/app/controllers/backoffice/dossiers_controller.rb b/app/controllers/backoffice/dossiers_controller.rb
index 61d3fdc16..1cced017a 100644
--- a/app/controllers/backoffice/dossiers_controller.rb
+++ b/app/controllers/backoffice/dossiers_controller.rb
@@ -51,7 +51,7 @@ class Backoffice::DossiersController < Backoffice::DossiersListController
   end
 
   def download_dossiers_tps
-    procedure = Procedure.find_by(id: params[:procedure_id])
+    procedure = current_gestionnaire.procedures.find_by(id: params[:procedure_id])
     export = procedure.generate_export
 
     respond_to do |format|
diff --git a/app/facades/dossier_facades.rb b/app/facades/dossier_facades.rb
index dfb7f73ab..a5143b6b3 100644
--- a/app/facades/dossier_facades.rb
+++ b/app/facades/dossier_facades.rb
@@ -38,7 +38,7 @@ class DossierFacades
   end
 
   def commentaires
-    @dossier.ordered_commentaires.where(champ_id: @champ_id).decorate
+    @dossier.commentaires.where(champ_id: @champ_id).decorate
   end
 
   def procedure
diff --git a/app/models/dossier.rb b/app/models/dossier.rb
index 61b7768c6..a53d49db3 100644
--- a/app/models/dossier.rb
+++ b/app/models/dossier.rb
@@ -128,10 +128,6 @@ class Dossier < ActiveRecord::Base
     champs.joins(', types_de_piece_justificative').where("pieces_justificatives.type_de_piece_justificative_id = types_de_piece_justificative.id AND types_de_piece_justificative.procedure_id = #{procedure.id}").order('order_place ASC')
   end
 
-  def ordered_commentaires
-    commentaires.order(created_at: :desc)
-  end
-
   def next_step! role, action, motivation = nil
     unless %w(initiate follow update comment receive refuse without_continuation close).include?(action)
       fail 'action is not valid'
@@ -242,8 +238,8 @@ class Dossier < ActiveRecord::Base
   def data_with_champs
     serialized_dossier = DossierTableExportSerializer.new(self)
     data = serialized_dossier.attributes.values
-    data += self.champs.order('type_de_champ_id ASC').map(&:value)
-    data += self.champs_private.order('type_de_champ_id ASC').map(&:value)
+    data += self.ordered_champs.map(&:value)
+    data += self.ordered_champs_private.map(&:value)
     data += self.export_entreprise_data.values
     return data
   end
@@ -251,8 +247,8 @@ class Dossier < ActiveRecord::Base
   def export_headers
     serialized_dossier = DossierTableExportSerializer.new(self)
     headers = serialized_dossier.attributes.keys
-    headers += self.procedure.types_de_champ.order('id ASC').map { |types_de_champ| types_de_champ.libelle.parameterize.underscore.to_sym }
-    headers += self.procedure.types_de_champ_private.order('id ASC').map { |types_de_champ| types_de_champ.libelle.parameterize.underscore.to_sym }
+    headers += self.procedure.types_de_champ.order(:order_place).map { |types_de_champ| types_de_champ.libelle.parameterize.underscore.to_sym }
+    headers += self.procedure.types_de_champ_private.order(:order_place).map { |types_de_champ| types_de_champ.libelle.parameterize.underscore.to_sym }
     headers += self.export_entreprise_data.keys
     return headers
   end
diff --git a/spec/controllers/admin/procedures_controller_spec.rb b/spec/controllers/admin/procedures_controller_spec.rb
index 9846ead56..bf6558912 100644
--- a/spec/controllers/admin/procedures_controller_spec.rb
+++ b/spec/controllers/admin/procedures_controller_spec.rb
@@ -1,4 +1,5 @@
 require 'spec_helper'
+require 'uri'
 
 describe Admin::ProceduresController, type: :controller do
   let(:admin) { create(:administrateur) }
@@ -54,9 +55,9 @@ describe Admin::ProceduresController, type: :controller do
   end
 
   describe 'DELETE #destroy' do
-    let(:procedure_draft) { create :procedure, published_at: nil, archived_at: nil }
-    let(:procedure_published) { create :procedure, published_at: Time.now, archived_at: nil }
-    let(:procedure_archived) { create :procedure, published_at: nil, archived_at: Time.now }
+    let(:procedure_draft) { create :procedure, administrateur: admin, published_at: nil, archived_at: nil }
+    let(:procedure_published) { create :procedure, administrateur: admin, published_at: Time.now, archived_at: nil }
+    let(:procedure_archived) { create :procedure, administrateur: admin, published_at: nil, archived_at: Time.now }
 
     subject { delete :destroy, params: {id: procedure.id} }
 
@@ -91,6 +92,14 @@ describe Admin::ProceduresController, type: :controller do
 
       it { expect(subject.status).to eq 401 }
     end
+
+    context "when administrateur does not own the procedure" do
+      let(:procedure_not_owned) { create :procedure, administrateur: create(:administrateur), published_at: nil, archived_at: nil }
+
+      subject { delete :destroy, params: {id: procedure_not_owned.id} }
+
+      it { expect{ subject }.to raise_error(ActiveRecord::RecordNotFound) }
+    end
   end
 
   describe 'GET #edit' do
@@ -468,7 +477,7 @@ describe Admin::ProceduresController, type: :controller do
         subject
       end
 
-      subject { get :path_list, params: {request: procedure2.path} }
+      subject { get :path_list, params: { request: URI.encode(procedure2.path) } }
 
       it { expect(response.status).to eq(200) }
       it { expect(body.size).to eq(1) }
@@ -527,4 +536,25 @@ describe Admin::ProceduresController, type: :controller do
       end
     end
   end
+
+  describe "POST hide" do
+    subject { post :hide, params: { id: procedure.id } }
+
+    context "when procedure is not owned by administrateur" do
+      let!(:procedure) { create :procedure, administrateur: create(:administrateur) }
+
+      it { expect{ subject }.to raise_error(ActiveRecord::RecordNotFound) }
+    end
+
+    context "when procedure is owned by administrateur" do
+      let!(:procedure) { create :procedure, administrateur: admin }
+
+      before do
+         subject
+         procedure.reload
+       end
+
+      it { expect(procedure.hidden_at).to_not eq nil }
+    end
+  end
 end
diff --git a/spec/controllers/api/v1/dossiers_controller_spec.rb b/spec/controllers/api/v1/dossiers_controller_spec.rb
index efb1d8cf2..937b1e662 100644
--- a/spec/controllers/api/v1/dossiers_controller_spec.rb
+++ b/spec/controllers/api/v1/dossiers_controller_spec.rb
@@ -227,8 +227,8 @@ describe API::V1::DossiersController do
               subject { super()[:type_de_champ] }
 
               it { expect(subject.keys.include?(:id)).to be_truthy }
-              it { expect(subject[:libelle]).to eq('Description') }
-              it { expect(subject[:description]).to eq('description de votre projet') }
+              it { expect(subject[:libelle]).to include('Libelle du champ') }
+              it { expect(subject[:description]).to include('description du champ') }
               it { expect(subject.keys.include?(:order_place)).to be_truthy }
               it { expect(subject[:type_champ]).to eq('text') }
             end
@@ -260,8 +260,8 @@ describe API::V1::DossiersController do
               subject { super()[:type_de_champ] }
 
               it { expect(subject.keys.include?(:id)).to be_truthy }
-              it { expect(subject[:libelle]).to eq('Description') }
-              it { expect(subject[:description]).to eq('description de votre projet') }
+              it { expect(subject[:libelle]).to include('Libelle champ privé') }
+              it { expect(subject[:description]).to include('description du champ privé') }
               it { expect(subject.keys.include?(:order_place)).to be_truthy }
               it { expect(subject[:type_champ]).to eq('text') }
             end
diff --git a/spec/factories/type_de_champ_private.rb b/spec/factories/type_de_champ_private.rb
index 356028d91..327a9e80f 100644
--- a/spec/factories/type_de_champ_private.rb
+++ b/spec/factories/type_de_champ_private.rb
@@ -1,7 +1,7 @@
 FactoryGirl.define do
   factory :type_de_champ_private do
-    libelle 'Description'
-    description 'description de votre projet'
+    sequence(:libelle) { |n| "Libelle champ privé #{n}" }
+    sequence(:description) { |n| "description du champ privé #{n}" }
     type_champ 'text'
     order_place 1
     mandatory false
diff --git a/spec/factories/type_de_champ_public.rb b/spec/factories/type_de_champ_public.rb
index 307ec2077..3e1acf1e8 100644
--- a/spec/factories/type_de_champ_public.rb
+++ b/spec/factories/type_de_champ_public.rb
@@ -1,7 +1,7 @@
 FactoryGirl.define do
   factory :type_de_champ_public do
-    libelle 'Description'
-    description 'description de votre projet'
+    sequence(:libelle) { |n| "Libelle du champ #{n}" }
+    sequence(:description) { |n| "description du champ #{n}" }
     type_champ 'text'
     order_place 1
     mandatory false
diff --git a/spec/models/administrateur_spec.rb b/spec/models/administrateur_spec.rb
index 538417c55..65cc16f5f 100644
--- a/spec/models/administrateur_spec.rb
+++ b/spec/models/administrateur_spec.rb
@@ -1,22 +1,6 @@
 require 'spec_helper'
 
 describe Administrateur, type: :model do
-  describe 'database column' do
-    it { is_expected.to have_db_column(:email) }
-    it { is_expected.to have_db_column(:encrypted_password) }
-    it { is_expected.to have_db_column(:reset_password_token) }
-    it { is_expected.to have_db_column(:reset_password_sent_at) }
-    it { is_expected.to have_db_column(:remember_created_at) }
-    it { is_expected.to have_db_column(:sign_in_count) }
-    it { is_expected.to have_db_column(:current_sign_in_at) }
-    it { is_expected.to have_db_column(:last_sign_in_at) }
-    it { is_expected.to have_db_column(:current_sign_in_ip) }
-    it { is_expected.to have_db_column(:last_sign_in_ip) }
-    it { is_expected.to have_db_column(:created_at) }
-    it { is_expected.to have_db_column(:updated_at) }
-    it { is_expected.to have_db_column(:api_token) }
-  end
-
   describe 'assocations' do
     it { is_expected.to have_and_belong_to_many(:gestionnaires) }
     it { is_expected.to have_many(:procedures) }
diff --git a/spec/models/cerfa_spec.rb b/spec/models/cerfa_spec.rb
index 4ea8dd675..f09242b6f 100644
--- a/spec/models/cerfa_spec.rb
+++ b/spec/models/cerfa_spec.rb
@@ -1,18 +1,6 @@
 require 'spec_helper'
 
 describe Cerfa do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:content) }
-    it { is_expected.to have_db_column(:original_filename) }
-    it { is_expected.to have_db_column(:content_secure_token) }
-    it { is_expected.to have_db_column(:created_at) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:dossier) }
-    it { is_expected.to belong_to(:user) }
-  end
-
   describe 'empty?', vcr: { cassette_name: 'models_cerfa_empty' } do
     subject { create(:cerfa, content: content) }
     context 'when content exist' do
diff --git a/spec/models/champ_shared_example.rb b/spec/models/champ_shared_example.rb
index 7dfe6bb1b..e09d2179d 100644
--- a/spec/models/champ_shared_example.rb
+++ b/spec/models/champ_shared_example.rb
@@ -1,19 +1,4 @@
 shared_examples 'champ_spec' do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:value) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:dossier) }
-    it { is_expected.to belong_to(:type_de_champ) }
-  end
-
-  describe 'delegation' do
-    it { is_expected.to delegate_method(:libelle).to(:type_de_champ) }
-    it { is_expected.to delegate_method(:type_champ).to(:type_de_champ) }
-    it { is_expected.to delegate_method(:order_place).to(:type_de_champ) }
-  end
-
   describe 'mandatory_and_blank?' do
     let(:type_de_champ) { TypeDeChamp.new(mandatory: mandatory) }
     let(:champ) { Champ.new(type_de_champ: type_de_champ, value: value) }
diff --git a/spec/models/dossier_spec.rb b/spec/models/dossier_spec.rb
index 6d5cfc268..a8f4b16ad 100644
--- a/spec/models/dossier_spec.rb
+++ b/spec/models/dossier_spec.rb
@@ -3,40 +3,6 @@ require 'spec_helper'
 describe Dossier do
   let(:user) { create(:user) }
 
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:autorisation_donnees) }
-    it { is_expected.to have_db_column(:created_at) }
-    it { is_expected.to have_db_column(:updated_at) }
-    it { is_expected.to have_db_column(:state) }
-    it { is_expected.to have_db_column(:procedure_id) }
-    it { is_expected.to have_db_column(:user_id) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:procedure) }
-    it { is_expected.to have_many(:pieces_justificatives) }
-    it { is_expected.to have_many(:champs) }
-    it { is_expected.to have_many(:commentaires) }
-    it { is_expected.to have_many(:quartier_prioritaires) }
-    it { is_expected.to have_many(:cadastres) }
-    it { is_expected.to have_many(:cerfa) }
-    it { is_expected.to have_one(:etablissement) }
-    it { is_expected.to have_one(:entreprise) }
-    it { is_expected.to have_one(:individual) }
-    it { is_expected.to belong_to(:user) }
-    it { is_expected.to have_many(:invites) }
-    it { is_expected.to have_many(:follows) }
-    it { is_expected.to have_many(:notifications) }
-  end
-
-  describe 'delegation' do
-    it { is_expected.to delegate_method(:siren).to(:entreprise) }
-    it { is_expected.to delegate_method(:siret).to(:etablissement) }
-    it { is_expected.to delegate_method(:types_de_piece_justificative).to(:procedure) }
-    it { is_expected.to delegate_method(:types_de_champ).to(:procedure) }
-    it { is_expected.to delegate_method(:france_connect_information).to(:user) }
-  end
-
   describe 'methods' do
     let(:dossier) { create(:dossier, :with_entreprise, user: user) }
 
@@ -497,7 +463,7 @@ describe Dossier do
     describe '#export_headers' do
       subject { dossier.export_headers }
 
-      it { expect(subject).to include(:description) }
+      it { expect(subject).to include(dossier.champs.first.libelle.parameterize.underscore.to_sym) }
       it { expect(subject).to include(:individual_gender) }
       it { expect(subject).to include(:individual_nom) }
       it { expect(subject).to include(:individual_prenom) }
diff --git a/spec/models/drop_down_list_spec.rb b/spec/models/drop_down_list_spec.rb
index 712e76d59..c75c9c74e 100644
--- a/spec/models/drop_down_list_spec.rb
+++ b/spec/models/drop_down_list_spec.rb
@@ -1,14 +1,6 @@
 require 'spec_helper'
 
 describe DropDownList do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:value) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:type_de_champ) }
-  end
-
   let(:dropdownlist) { create :drop_down_list, value: value }
 
   describe '#options' do
diff --git a/spec/models/entreprise_spec.rb b/spec/models/entreprise_spec.rb
index e89a1c558..0a901fb3e 100644
--- a/spec/models/entreprise_spec.rb
+++ b/spec/models/entreprise_spec.rb
@@ -1,24 +1,4 @@
 require 'spec_helper'
 
 describe Entreprise do
-  describe 'databse columns' do
-    it { is_expected.to have_db_column(:siren) }
-    it { is_expected.to have_db_column(:capital_social) }
-    it { is_expected.to have_db_column(:numero_tva_intracommunautaire) }
-    it { is_expected.to have_db_column(:forme_juridique) }
-    it { is_expected.to have_db_column(:forme_juridique_code) }
-    it { is_expected.to have_db_column(:nom_commercial) }
-    it { is_expected.to have_db_column(:raison_sociale) }
-    it { is_expected.to have_db_column(:siret_siege_social) }
-    it { is_expected.to have_db_column(:code_effectif_entreprise) }
-    it { is_expected.to have_db_column(:date_creation) }
-    it { is_expected.to have_db_column(:nom) }
-    it { is_expected.to have_db_column(:prenom) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:dossier) }
-    it { is_expected.to have_one(:etablissement) }
-    it { is_expected.to have_one(:rna_information) }
-  end
 end
diff --git a/spec/models/etablissement_spec.rb b/spec/models/etablissement_spec.rb
index c89d5ec43..abc982ad4 100644
--- a/spec/models/etablissement_spec.rb
+++ b/spec/models/etablissement_spec.rb
@@ -1,27 +1,6 @@
 require 'spec_helper'
 
 describe Etablissement do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:siret) }
-    it { is_expected.to have_db_column(:siege_social) }
-    it { is_expected.to have_db_column(:naf) }
-    it { is_expected.to have_db_column(:libelle_naf) }
-    it { is_expected.to have_db_column(:adresse) }
-    it { is_expected.to have_db_column(:numero_voie) }
-    it { is_expected.to have_db_column(:type_voie) }
-    it { is_expected.to have_db_column(:nom_voie) }
-    it { is_expected.to have_db_column(:complement_adresse) }
-    it { is_expected.to have_db_column(:code_postal) }
-    it { is_expected.to have_db_column(:localite) }
-    it { is_expected.to have_db_column(:code_insee_localite) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:dossier) }
-    it { is_expected.to belong_to(:entreprise) }
-    it { is_expected.to have_many(:exercices) }
-  end
-
   describe '#geo_adresse' do
     let(:etablissement) { create(:etablissement) }
 
diff --git a/spec/models/exercice_spec.rb b/spec/models/exercice_spec.rb
index cfd6dc798..cf64c6cfc 100644
--- a/spec/models/exercice_spec.rb
+++ b/spec/models/exercice_spec.rb
@@ -1,13 +1,4 @@
 require 'spec_helper'
 
 describe Exercice do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:ca) }
-    it { is_expected.to have_db_column(:dateFinExercice) }
-    it { is_expected.to have_db_column(:date_fin_exercice_timestamp) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:etablissement) }
-  end
 end
diff --git a/spec/models/france_connect_information_spec.rb b/spec/models/france_connect_information_spec.rb
index 2bc10de48..330fc679c 100644
--- a/spec/models/france_connect_information_spec.rb
+++ b/spec/models/france_connect_information_spec.rb
@@ -1,20 +1,6 @@
 require 'spec_helper'
 
 describe FranceConnectInformation, type: :model do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:given_name) }
-    it { is_expected.to have_db_column(:family_name) }
-    it { is_expected.to have_db_column(:email_france_connect) }
-    it { is_expected.to have_db_column(:birthdate) }
-    it { is_expected.to have_db_column(:gender) }
-    it { is_expected.to have_db_column(:birthplace) }
-    it { is_expected.to have_db_column(:france_connect_particulier_id) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:user) }
-  end
-
   describe 'validation' do
     context 'france_connect_particulier_id' do
       it { is_expected.not_to allow_value(nil).for(:france_connect_particulier_id) }
diff --git a/spec/models/gestionnaire_spec.rb b/spec/models/gestionnaire_spec.rb
index 200ccb692..18b8461d9 100644
--- a/spec/models/gestionnaire_spec.rb
+++ b/spec/models/gestionnaire_spec.rb
@@ -13,30 +13,6 @@ describe Gestionnaire, type: :model do
     create :assign_to, gestionnaire: gestionnaire, procedure: procedure_2
   end
 
-  describe 'database column' do
-    it { is_expected.to have_db_column(:email) }
-    it { is_expected.to have_db_column(:encrypted_password) }
-    it { is_expected.to have_db_column(:reset_password_token) }
-    it { is_expected.to have_db_column(:reset_password_sent_at) }
-    it { is_expected.to have_db_column(:remember_created_at) }
-    it { is_expected.to have_db_column(:sign_in_count) }
-    it { is_expected.to have_db_column(:current_sign_in_at) }
-    it { is_expected.to have_db_column(:last_sign_in_at) }
-    it { is_expected.to have_db_column(:current_sign_in_ip) }
-    it { is_expected.to have_db_column(:last_sign_in_ip) }
-    it { is_expected.to have_db_column(:created_at) }
-    it { is_expected.to have_db_column(:updated_at) }
-  end
-
-  describe 'association' do
-    it { is_expected.to have_one(:preference_smart_listing_page) }
-    it { is_expected.to have_and_belong_to_many(:administrateurs) }
-    it { is_expected.to have_many(:procedures) }
-    it { is_expected.to have_many(:dossiers) }
-    it { is_expected.to have_many(:follows) }
-    it { is_expected.to have_many(:preference_list_dossiers) }
-  end
-
   describe '#toggle_follow_dossier' do
     let!(:dossier) { create :dossier, procedure: procedure }
 
diff --git a/spec/models/invite_spec.rb b/spec/models/invite_spec.rb
index e6c637d69..63978930d 100644
--- a/spec/models/invite_spec.rb
+++ b/spec/models/invite_spec.rb
@@ -1,15 +1,6 @@
 require 'spec_helper'
 
 describe Invite do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:email) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:dossier) }
-    it { is_expected.to belong_to(:user) }
-  end
-
   describe 'an email can be used for multiple dossier' do
     let(:email1) { 'plop@octo.com' }
 
diff --git a/spec/models/piece_justificative_spec.rb b/spec/models/piece_justificative_spec.rb
index 62da2cd96..0cfd6aee2 100644
--- a/spec/models/piece_justificative_spec.rb
+++ b/spec/models/piece_justificative_spec.rb
@@ -1,20 +1,6 @@
 require 'spec_helper'
 
 describe PieceJustificative do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:content) }
-    it { is_expected.to have_db_column(:original_filename) }
-    it { is_expected.to have_db_column(:content_secure_token) }
-    it { is_expected.to have_db_column(:created_at) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:dossier) }
-    it { is_expected.to belong_to(:type_de_piece_justificative) }
-    it { is_expected.to belong_to(:user) }
-    it { is_expected.to have_one(:commentaire) }
-  end
-
   describe 'validations' do
     context 'content' do
       it { is_expected.not_to allow_value(nil).for(:content) }
@@ -22,11 +8,6 @@ describe PieceJustificative do
     end
   end
 
-  describe 'delegation' do
-    it { is_expected.to delegate_method(:libelle).to(:type_de_piece_justificative) }
-    it { is_expected.to delegate_method(:api_entreprise).to(:type_de_piece_justificative) }
-  end
-
   describe '#empty?', vcr: { cassette_name: 'model_piece_justificative' } do
     let(:piece_justificative) { create(:piece_justificative, content: content) }
     subject { piece_justificative.empty? }
diff --git a/spec/models/preference_list_dossier_spec.rb b/spec/models/preference_list_dossier_spec.rb
index 9ddb467f5..000ad7ff7 100644
--- a/spec/models/preference_list_dossier_spec.rb
+++ b/spec/models/preference_list_dossier_spec.rb
@@ -306,7 +306,7 @@ describe PreferenceListDossier do
         describe 'first champs' do
           subject { super()["type_de_champ_#{procedure.types_de_champ.first.id}"] }
 
-          it { expect(subject[:libelle]).to eq 'Description' }
+          it { expect(subject[:libelle]).to eq procedure.types_de_champ.first.libelle }
           it { expect(subject[:table]).to eq 'champs' }
           it { expect(subject[:attr]).to eq procedure.types_de_champ.first.id }
           it { expect(subject[:attr_decorate]).to eq 'value' }
@@ -324,7 +324,7 @@ describe PreferenceListDossier do
         describe 'first champs' do
           subject { super()["type_de_champ_private_#{procedure.types_de_champ_private.first.id}"] }
 
-          it { expect(subject[:libelle]).to eq 'Description' }
+          it { expect(subject[:libelle]).to eq procedure.types_de_champ_private.first.libelle }
           it { expect(subject[:table]).to eq 'champs_private' }
           it { expect(subject[:attr]).to eq procedure.types_de_champ_private.first.id }
           it { expect(subject[:attr_decorate]).to eq 'value' }
diff --git a/spec/models/procedure_spec.rb b/spec/models/procedure_spec.rb
index 07dd724e9..249b21931 100644
--- a/spec/models/procedure_spec.rb
+++ b/spec/models/procedure_spec.rb
@@ -336,6 +336,39 @@ describe Procedure do
 
       it { expect(subject[:data].size).to eq(2) }
       it { expect(subject[:headers]).to eq(dossier.export_headers) }
+
+      context 'with ordered champs' do
+        let(:tc_2) { create(:type_de_champ_public, order_place: 2) }
+        let(:tc_1) { create(:type_de_champ_public, order_place: 1) }
+        let(:tcp_2) { create(:type_de_champ_private, order_place: 2) }
+        let(:tcp_1) { create(:type_de_champ_private, order_place: 1) }
+
+        before do
+          procedure.types_de_champ << tc_2 << tc_1
+          procedure.types_de_champ_private << tcp_2 << tcp_1
+
+          dossier.build_default_champs
+          dossier.champs.find_by(type_de_champ: tc_1).update_attributes(value: "value 1")
+          dossier.champs.find_by(type_de_champ: tc_2).update_attributes(value: "value 2")
+          dossier.champs_private.find_by(type_de_champ: tcp_1).update_attributes(value: "private value 1")
+          dossier.champs_private.find_by(type_de_champ: tcp_2).update_attributes(value: "private value 2")
+
+          dossier2.build_default_champs
+          dossier2.champs.find_by(type_de_champ: tc_1).update_attributes(value: "value 1")
+          dossier2.champs.find_by(type_de_champ: tc_2).update_attributes(value: "value 2")
+          dossier2.champs_private.find_by(type_de_champ: tcp_1).update_attributes(value: "private value 1")
+          dossier2.champs_private.find_by(type_de_champ: tcp_2).update_attributes(value: "private value 2")
+        end
+
+        it { expect(subject[:headers].index(tc_1.libelle.parameterize.underscore.to_sym)).to be < subject[:headers].index(tc_2.libelle.parameterize.underscore.to_sym) }
+        it { expect(subject[:headers].index(tcp_1.libelle.parameterize.underscore.to_sym)).to be < subject[:headers].index(tcp_2.libelle.parameterize.underscore.to_sym) }
+
+        it { expect(subject[:data][0].index("value 1")).to be < subject[:data].first.index("value 2") }
+        it { expect(subject[:data][0].index("private value 1")).to be < subject[:data].first.index("private value 2") }
+
+        it { expect(subject[:data][1].index("value 1")).to be < subject[:data].first.index("value 2") }
+        it { expect(subject[:data][1].index("private value 1")).to be < subject[:data].first.index("private value 2") }
+      end
     end
 
     context 'when there is a draft dossier' do
diff --git a/spec/models/rna_information_spec.rb b/spec/models/rna_information_spec.rb
index 807783396..89537c245 100644
--- a/spec/models/rna_information_spec.rb
+++ b/spec/models/rna_information_spec.rb
@@ -1,16 +1,4 @@
 require 'spec_helper'
 
 describe RNAInformation do
-  describe 'databse columns' do
-    it { is_expected.to have_db_column(:association_id) }
-    it { is_expected.to have_db_column(:titre) }
-    it { is_expected.to have_db_column(:objet) }
-    it { is_expected.to have_db_column(:date_creation) }
-    it { is_expected.to have_db_column(:date_publication) }
-    it { is_expected.to have_db_column(:date_declaration) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:entreprise) }
-  end
 end
diff --git a/spec/models/type_de_champ_shared_example.rb b/spec/models/type_de_champ_shared_example.rb
index 3ed2e0f0c..fbe3b24de 100644
--- a/spec/models/type_de_champ_shared_example.rb
+++ b/spec/models/type_de_champ_shared_example.rb
@@ -1,16 +1,4 @@
 shared_examples 'type_de_champ_spec' do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:libelle) }
-    it { is_expected.to have_db_column(:type_champ) }
-    it { is_expected.to have_db_column(:order_place) }
-    it { is_expected.to have_db_column(:description) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:procedure) }
-    it { is_expected.to have_many(:champ) }
-  end
-
   describe 'validation' do
     context 'libelle' do
       it { is_expected.not_to allow_value(nil).for(:libelle) }
diff --git a/spec/models/type_de_piece_justificative_spec.rb b/spec/models/type_de_piece_justificative_spec.rb
index 584c7a555..c6ee609d2 100644
--- a/spec/models/type_de_piece_justificative_spec.rb
+++ b/spec/models/type_de_piece_justificative_spec.rb
@@ -3,21 +3,6 @@ require 'spec_helper'
 describe TypeDePieceJustificative do
   let!(:procedure) { create(:procedure) }
 
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:libelle) }
-    it { is_expected.to have_db_column(:description) }
-    it { is_expected.to have_db_column(:api_entreprise) }
-    it { is_expected.to have_db_column(:created_at) }
-    it { is_expected.to have_db_column(:updated_at) }
-    it { is_expected.to have_db_column(:order_place) }
-    it { is_expected.to have_db_column(:lien_demarche) }
-  end
-
-  describe 'associations' do
-    it { is_expected.to have_many(:pieces_justificatives) }
-    it { is_expected.to belong_to(:procedure) }
-  end
-
   describe 'validation' do
     context 'libelle' do
       it { is_expected.not_to allow_value(nil).for(:libelle) }
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 552d42bca..58bd78bc2 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1,28 +1,6 @@
 require 'spec_helper'
 
 describe User, type: :model do
-  describe 'database columns' do
-    it { is_expected.to have_db_column(:email) }
-    it { is_expected.to have_db_column(:encrypted_password) }
-    it { is_expected.to have_db_column(:reset_password_token) }
-    it { is_expected.to have_db_column(:reset_password_sent_at) }
-    it { is_expected.to have_db_column(:remember_created_at) }
-    it { is_expected.to have_db_column(:sign_in_count) }
-    it { is_expected.to have_db_column(:current_sign_in_at) }
-    it { is_expected.to have_db_column(:last_sign_in_at) }
-    it { is_expected.to have_db_column(:current_sign_in_ip) }
-    it { is_expected.to have_db_column(:last_sign_in_ip) }
-    it { is_expected.to have_db_column(:created_at) }
-    it { is_expected.to have_db_column(:updated_at) }
-    it { is_expected.to have_db_column(:siret) }
-    it { is_expected.to have_db_column(:loged_in_with_france_connect) }
-  end
-  describe 'associations' do
-    it { is_expected.to have_many(:dossiers) }
-    it { is_expected.to have_many(:invites) }
-    it { is_expected.to have_many(:piece_justificative) }
-    it { is_expected.to have_many(:cerfa) }
-  end
   describe '#find_for_france_connect' do
     let(:siret) { '00000000000000' }
     context 'when user exist' do