Authentication & Access Control Reversing NEWSEQUENTIALID() Into a Predictable GUID Counter
A restaurant ordering API blanked out every guest's name, email, and phone number and trusted the order's GUID to keep them secret. It turned out the GUID was a counter, and a second endpoint gave the names back for free.
