Use random IDs that cannot be guessed. UUIDs are preferred but any other random string will do. Using numeric IDs can lead to enumeration attacks where attackers iterate through possible ID values.
OWASP API1 2023 No Numeric IDs
Message: Use random IDs that cannot be guessed, UUIDs are preferred.
