There are few hard and fast rules, but "never use something that could change as a primary key" and "never roll your own Auth" will always be true