6 ms·

Thanks for your answer! Makes me curious how do you defend against people simply bruteforcing or guessing the account numbers.

• BrunoBernardino 3mo ago
  Rate limiting when it's invalid (and high entropy to generate new ones)! It's in the FAQ :)