UUIDv4 vs UUIDv7 in PostgreSQL: A B-Tree Index Performance Deep Dive

Migrating MedicoSync: UUIDv4 → UUIDv7

(Why I'm doing it, and why it's cheap to defer)

When building MedicoSync (an open-source FastAPI + PostgreSQL medical records platform), hiding internal database IDs was a key requirement on Day 1 [source: 0.1.1].

The Problem with Integers: Simple sequential numbers like /api/v1/patients/42 leak data. A malicious user can guess the next numbers and scan your endpoints like /43, /44, or /45.

The Vulnerability: This mistake is called an IDOR (Insecure Direct Object Reference) vulnerability.