Hacker News Reader

Thanks for your answer! Makes me curious how do you defend against people simply bruteforcing or guessing the account numbers.

Rate limiting when it's invalid (and high entropy to generate new ones)! It's in the FAQ :)