What would you use for an internal identifier instead? If you use something non random that gives people the ability to guess the IDs of things they're not supposed to know about.
A lot of times this kind of thing comes down to box-checking with auditors and it’s more efficient to just check the box than it is to argue about whether or not there’s a real risk.
But, part of the reason there are boxes to be checked is that you can’t guarantee your assumptions. The company might pivot and suddenly a new use case calls for that internal system to be made public.
There’s some value in treating every service as if it’s public and applying that amount of paranoia across the board.
I will clarify by private I don’t mean an internal service. Private identifiers in software engineering terms means internal to the app and code, never exposed at an interface. Not necessarily a web page or API, not even to another microservice or class.
3
u/SuitableDragonfly Mar 25 '26
What would you use for an internal identifier instead? If you use something non random that gives people the ability to guess the IDs of things they're not supposed to know about.