One thought is to move this to an API method as you suggested and then it could use a random 10 character prefix generated at startup. This way you can't know what the magic prefix is going to be and bruteforcing 10^36 isn't quick. I didn't suggest 36 characters as the longer the IDs the more memory we eat up in cache entries (and there will be lots of them). WDYT?