Summary
short_id() in src/types.rs generates 8-character hex IDs (32 bits of entropy) by taking the last 8 characters of a UUID v4:
pub fn short_id() -> String {
let uuid = Uuid::new_v4();
uuid.to_string()
.chars()
.rev()
.take(8)
.collect::<String>()
.chars()
.rev()
.collect()
}With ~65,000 instances the birthday paradox gives a 50% collision probability. A collision causes a hard PRIMARY KEY violation on df.instances.id.
Severity
Low-Medium — not silent (PK violation surfaces as an error), but a production system at moderate throughput will hit this within months to years.
Fix
Drop short_id() and use a full UUID (or at minimum 16 hex characters / 64 bits of entropy). Full UUID eliminates the problem entirely and is the simplest fix.
Summary
short_id()insrc/types.rsgenerates 8-character hex IDs (32 bits of entropy) by taking the last 8 characters of a UUID v4:With ~65,000 instances the birthday paradox gives a 50% collision probability. A collision causes a hard PRIMARY KEY violation on
df.instances.id.Severity
Low-Medium — not silent (PK violation surfaces as an error), but a production system at moderate throughput will hit this within months to years.
Fix
Drop
short_id()and use a full UUID (or at minimum 16 hex characters / 64 bits of entropy). Full UUID eliminates the problem entirely and is the simplest fix.