Why UUIDs won’t protect your secrets