Nah, not that much ad-hoc here. So far I tried to at least in the code that passed my eyes to not rely too much on ids coming from external ids :)
But agreed that such things should be officially noted somewhere, so everyone is aware or could use that to check things.
Time for a README-security.md