Replace sequential integer IDs (1, 2, 3, 1041, 1042) with UUIDs — long, randomly generated identifiers that look like this: 550e8400-e29b-41d4-a716-446655440000

With a UUID, an attacker can't guess the next ID. They can't enumerate. There are 340 undecillion possible UUIDs — brute-forcing them is computationally impossible.

Sequential IDs are like apartment numbers on a door — labeled, guessable, countable. UUIDs are like a randomly generated 36-character keycode on each door. You can't guess your neighbor's by knowing yours.

UUIDs are not a replacement for authorization checks. If the API still returns data to anyone who sends a valid UUID — and UUIDs can be shared, leaked, or found in URLs — BOLA still exists. UUIDs raise the bar, they don't close the door. MIT 01 is still required.