From 7de9ee2a7ce0fa109814bc6ea5dc48522dcc66ef Mon Sep 17 00:00:00 2001 From: claudio Date: Wed, 22 Apr 2026 23:18:36 +0200 Subject: [PATCH] Default to 8-char slugs for public-internet-safe entropy 5-char slugs over a 32-char alphabet are ~25 bits; brute-forceable at HTTP speeds once the endpoint is public. 8 chars = 40 bits (~10^12 combinations), infeasible to scan within useful timescales. Existing 5-char slugs still resolve; only new artifacts use the longer form. --- internal/store/artifacts.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/store/artifacts.go b/internal/store/artifacts.go index 96035f1..10f79cc 100644 --- a/internal/store/artifacts.go +++ b/internal/store/artifacts.go @@ -38,7 +38,7 @@ type CreateOptions struct { func (s *Store) CreateArtifact(opts CreateOptions) (*Artifact, error) { slug := strings.ToLower(strings.TrimSpace(opts.Slug)) if slug == "" { - g, err := s.generateSlug(5) + g, err := s.generateSlug(8) if err != nil { return nil, err }