Don't expose DB id's to the outside world

[idolpx]

Don't expose DB id's to the outside world

[idolpx]

Ok... I'm going to split this into two individual requirements.
What is the reasoning for using a GUID rather than sequential IDs?

[Nico-van-der-Zijden]

You should use both in your DB where the id is the pk, you can use the id server side but when exposing the data through an api you should use the guid instead of the id.
It's more of a security thing, if you expose the id of a record someone can easily decrease/increase that id and possibly retrieve data which they shouldn't, guessing a corect guid is a 'bit' harder.

[idolpx]

That makes sense. I guess we need to define what information should not be accessible.
I don't think there is anything about a release, group, scener, handle, event, bbs, or sid that needs to be protected.

Of course a user's login info would need to be protected when logging in via the API.

[idolpx]

I've added "uuid" to the major types in the schema.