gamejam | Tool for generating randomized gamejam 's ideas

A socket.id lasts only for the duration of a given socket.io session. A future socket.io connection from the same client will be given a new socket.id. As such, it is NOT a lasting identifier and thus I wouldn't think it would be very useful for a leaderboard because it would not necessarily attribute multiple scores from the same user (in different sessions) to be the same user. Instead, you would want a lasting user identifier that your own server creates (usually as part of a user signup/signin process) and can long term make sure it's both unique and that the same client gets the same identifier each time.

As to how unique a socket.id is, it is coined via random number generation. It uses the module base64id to create the unique id and the doc for that module says that it uses crypto.randomBytes(). You can see the implementation here.

So, with random number generation, it is probabilistically unique, not guaranteed unique. At first look at the base64id module, it appears that it appends an increasing number to the random bytes under some circumstances which could make it guaranteed unique during a server lifetime (without server restarts) assuming no roll-over of the increasing digits, but still won't keep the same id for the same client across different sessions.

should it be kept private

A socket.id is created/assigned at the server, thus there is no ability for a client to try to spoof or use some other user's socket.id. As such, there's no particular reason to keep it private. It's just a unique id that socket.io uses for internal bookkeeping to keep track of state for a given connection.

If you've ever looked at a socket.id, it is not particularly meant for human consumption and/or displaying in a UI. It's a string of base64 that will look largely like gibberish to most regular users if displayed in a leaderboard. More commonly, a user would specify their own "display name" when they signed up for your service and you'd use that in a leaderboard and you'd use that as the persistent identifier from one session to the next.