Audit my ID strategy. Find how records are identified in the database and, separately, how they're identified in URLs, API responses, and anywhere a user can see an ID. Apply: internal primary keys can stay whatever's efficient (sequential integers are fine inside the database), but any ID exposed to users must be unguessable: UUIDs or random token-style IDs for public references. Find every URL pattern like /users/123 or /invoices/47 and switch it to the public ID. Add a unique index on the public ID column. Make sure authorization still checks ownership on every lookup, since unguessable IDs are a layer, not a permission system. Don't change primary keys on existing tables with live foreign keys; add a public ID column and backfill it instead. Don't expose both ID forms in the same API response where the mapping lets someone correlate them. Don't treat this as a replacement for the authorization checks that already exist. Deliver: the public ID scheme, the backfill migration, every route and query switched over, and verification: confirm sequential enumeration of public URLs returns nothing and that the old sequential IDs no longer appear in any response.