[Fixed]-When to redirect when to render

The common pattern for this sort of behaviour is to use a redirect.

I would personally prefer that as it avoid the confuson of one view doing two things – one view displays and processes the form, the other displays a success message.

If the user manages to POST the form data a second time, what do you do?

https://en.wikipedia.org/wiki/Post/Redirect/Get

I am not aware of any greater security risk from using render rather than redirect (though someone with more expertise may know more than me about that).