While auditing Web applications, our experts found a vulnerability to enumeration attacks. Here is a description of the problem and how to combat it.