Security issues exposing database SID?

We are considering exposing a webservice both internally and externally.

For support reasons, we would like the response payload to include the database SID that the service is connected to. This makes it easier for us to debug issues in development environments where systems and services are not always pointing where they should be.

However, since the service may be exposed externally, we are concerned about the security ramifications of having our database SID known to the world.

1. What are the security risks of exposing your SID, if any?
2. Would using DBID (i.e., v$database.dbid) be better?

Thanks in advance!

Matt

--
http://www.freelists.org/webpage/oracle-l