{"action":"opened","issue":{"url":"https://api.github.com/repos/jcypret/hashid-rails/issues/4","labels_url":"https://api.github.com/repos/jcypret/hashid-rails/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/jcypret/hashid-rails/issues/4/comments","events_url":"https://api.github.com/repos/jcypret/hashid-rails/issues/4/events","html_url":"https://github.com/jcypret/hashid-rails/issues/4","id":113098926,"number":4,"title":"Use secure salt for generating HashIDs object","user":{"login":"olliebennett","id":1068525,"avatar_url":"https://avatars.githubusercontent.com/u/1068525?v=3","gravatar_id":"","url":"https://api.github.com/users/olliebennett","html_url":"https://github.com/olliebennett","followers_url":"https://api.github.com/users/olliebennett/followers","following_url":"https://api.github.com/users/olliebennett/following{/other_user}","gists_url":"https://api.github.com/users/olliebennett/gists{/gist_id}","starred_url":"https://api.github.com/users/olliebennett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olliebennett/subscriptions","organizations_url":"https://api.github.com/users/olliebennett/orgs","repos_url":"https://api.github.com/users/olliebennett/repos","events_url":"https://api.github.com/users/olliebennett/events{/privacy}","received_events_url":"https://api.github.com/users/olliebennett/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-23T20:56:16Z","updated_at":"2015-10-23T20:56:16Z","closed_at":null,"body":"This gem uses the `table_name` of the model as the salt for encoding HashIDs. It's great that the hash used differs between models (by depending on the table name), but it would be more secure to use something unique to the server in addition.\r\n\r\nWhat do you think about concatenating a secret server key into the salt, like so:\r\n\r\n```ruby\r\nhashids = Hashids.new(\"#{table_name}#{ENV['SECRET_KEY_BASE']}\")\r\n```\r\n\r\nWe should use something more secure; if not the `SECRET_KEY_BASE` then something configured via `initializers/hashids.rb` or similar?"}}