(It may seem trivial, and probably is trivial) I wrote about obfuscating the primary keys for your critical tables here: http://www.kanske.com/?p=7

I came across a reason why you do that recently when I discovered a potential chipin.com competitor.

A friend brought up the fact that we (chipin.com) have a competitor (Pledgie.com). The first thing that comes to mind is, how many customers do they have? How many events in their system? How much money have they collected? Do we need to worry about them?

They expose the primary key for both their account table and their event table. It appears that they have less than 42 campaigns (max campaign id at the time http://pledgie.com/campaign/show/42) and less than 87 users (max account id is 87 http://pledgie.com/account/show/87).

With a fixed number of events and users it’s possible to write a script to summarize how much money has been collected.

This isn’t the only source of such information, but it sure is low-hanging fruit.