Memory Appendix
No Sequential Ids In Urls
Never expose sequential/enumerable IDs in user-facing URLs — use UUIDs instead
Source memory file:
feedback_no_sequential_ids_in_urls.md· Category: Feedback / working-preference This is a verbatim dump of Claude's persistent memory for the Octopus project. Rendered inside a code block so nothing is altered.
---
name: No sequential IDs in external URLs
description: Never expose sequential/enumerable IDs in user-facing URLs — use UUIDs instead
type: feedback
---
Never expose sequential IDs in user-facing URLs in Grasshopper. Use UUIDs for anything in a URL path or query param.
**Why:** Sequential IDs are enumerable — attackers can loop through them to scrape data.
**How to apply:** Add a UUID `public_id` column to tables that appear in URLs. Use that in routes instead of the integer PK.