5-char slugs over a 32-char alphabet are ~25 bits; brute-forceable at HTTP speeds once the endpoint is public. 8 chars = 40 bits (~10^12 combinations), infeasible to scan within useful timescales. Existing 5-char slugs still resolve; only new artifacts use the longer form.