I hope that it's obvious that you shouldn't expose part of your implementation to your end users a la auto incrementing primary keys.

Obfuscation of how data is queried and stored is pretty low hanging fruit, security-wise.