Counting the Competition

A retailer puts its bigint auto-increment order id straight into customer-facing URLs. A competitor buys one item a week and subtracts consecutive order numbers to estimate weekly volume, and a researcher reports that changing the number in the URL loads other customers' orders. What is the right response?

Keep the sequential identifier and encrypt it in the URL with a key that only the application holds and decrypts on each request before loading the order

Give each order a separate non-sequential opaque identifier for external use, keep the bigint as the internal key, and enforce ownership checks on every request

Replace the external identifier with a random opaque token, which makes an order impossible to guess and therefore closes both the disclosure and the access problem

Keep the sequential identifier but start the counter at a large number and increment by a random step between 50 and 500 so volume cannot be read off