Is there any (security) risk in having user ids public?

We have a ‘users’ table with an incrementing integer as id (doesn’t everyone have this?).

Is there any risk to use this ID for example in something like PostHog / sentry to identify the user?

And also, is there any risk in exposing this ID to the user’s browser?

I’ve considered generating a UUID for every user to use that as a ‘public’ id. But I just can’t imagine the benefit. The downside is that it’s simply more work to create this and manage this.

Community Page
Last updated: