Happy to hear there was no evidence of this being exploited. This is one of those things you really want to fix. Relying on an ID value being hard to guess as

Happy to hear there was no evidence of this being exploited. This is one of those things you really want to fix. Relying on an ID value being hard to guess as a security measure can be easily become one of those completely-invisible-but-critically-load-bearing (in)security properties that is too easy to invalidate with new pushes/features/etc. If these IDs were able to be exfiltrated or leaked or probed, it could have been disastrous. Really fortunate that this was caught now and wasn't in the wild for another year or two.