That's what the RFC states: > Timestamps embedded in the UUID do pose a very small attack surface. The timestamp in conjunction with an embedded counter does s

That's what the RFC states: > Timestamps embedded in the UUID do pose a very small attack surface. The timestamp in conjunction with an embedded counter does signal the order of creation for a given UUID and its corresponding data but does not define anything about the data itself or the application as a whole. If UUIDs are required for use with any security operation within an application context in any shape or form, then UUIDv4 (Section 5.4) SHOULD be utilized. https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations https://datatracker.ietf.org/doc/html/rfc9562#name-security-...