0009 — Identifiers and randomness

Status: accepted

Decision

• No entity, resource, URL or API object uses sequential or numeric identifiers. They are enumerable and leak volume and order.
• Identifiers are RFC 9562 UUID v4. The 122 random bits come from the operating-system CSPRNG: crypto.getRandomValues in TypeScript, RandomNumberGenerator.Fill in C#. Both are seeded and reseeded from hardware entropy (RDRAND/RDSEED, TPM, interrupt timing). Raw hardware RNG instructions aren’t exposed to JavaScript and aren’t recommended as a sole source, so the OS CSPRNG is the hardware-backed path.
• Tokens, salts and secrets use the same source. Math.random() and System.Random are never used for anything security-relevant.
• Unguessable ids are not authorization. Every server-side access is still checked against the resource’s policy.