We should not be specifying the salt as a constant. about short-url

[ash-jc-allen]

@ppshobi Although I don't see this as being a huge concern that the IDs will be the same across different sites (because this package shouldn't be used for generating secure URLs), I do agree with you!

I think this could be a feature included in a future release :)

[ppshobi]

well, this could definitely land in a future release, I would like to point out one more issue with specifying the salt as a constant. Even though this library should not be used as a way to generate secure URLs, once a URL is available, I could easily fingerprint the total number of URLs you have and go to other peoples URLs even without any prior information. This potentially could open up a whole new level of options to fingerprint all the information on the shortinks table and poses a security threat as well.

And once people start using it, changing the salt can be potentially risky

[ash-jc-allen]

@ppshobi As mentioned before, I do agree with you about not having the salt as a constant.
Like you say, you could work your way backwards after getting one URL and could try and look at the previously created short URLs as well. However, I wouldn't say that this is a security issue as such. This package is aimed at things like adding short URLs for digital marketing purposes rather than anything that is sensitive or private.
I've created a new branch on this repo for v2.1.0 if you'd like to make a pull request with the new feature? :)