Security

Security

Core boundary

Identifiers identify. Tokens authenticate. Policies authorize.

Possession of a MID, PID, or REF must never grant access. In the disputed-charge example, Alice's ability to enter a valid REF does not authorize her to view Bob's order. The application must authenticate Alice and evaluate its authorization policy before returning data.

Disclosure properties

• UUIDv7 MIDs reveal approximate creation time.
• PIDs carry the same timestamp-bearing UUID bits and reveal their registered resource prefix.
• Sequential REFs reveal volume and ordering within their scope.
• Random REFs reduce predictability but are not secrets.

Choose public exposure and REF strategy with these properties understood.

Random-reference safety

• Use a cryptographically secure random source.
• Use unbiased sampling for Crockford Base32 symbols.
• Establish uniqueness through an atomic constraint.
• Bound retries and surface allocation exhaustion.
• Do not log random bytes, credentials, or private entity data during failures.

Input handling

• Normalize before comparison or storage.
• Preserve stable machine-readable error codes.
• Treat a valid checksum as typo detection only.
• Resolve a REF through storage before claiming it exists.
• Keep authentication and authorization failures separate from identifier syntax errors.

Reporting vulnerabilities

Use the repository's private security-advisory channel. Do not open a public issue for an undisclosed vulnerability and never include live credentials or personal data in a report.

See the canonical security policy.