Who has been "pwn3d" by exposing their user count? It's less about direct "pwn3ge" than about business intelligence. The number of users could be sensitive in

Who has been "pwn3d" by exposing their user count? It's less about direct "pwn3ge" than about business intelligence. The number of users could be sensitive information for some businesses, but it's not just users. Any item where your volume is valuable proprietary information, you better make sure you aren't exposing an auto-incrementing id. Number of accounts, number of daily orders, number of distribution centers, number of product models, these might be data points that a growing business would prefer not to expose to their competitors via, for example, URL query parameters. You should make competitors work harder for their intelligence.