At first I thought “how is this relevant?” but increasingly yeah, us web developers to use HTTP 404 rather than HTTP 403 increasingly as it can be more secure to pretend something doesn’t exist than to explicitly say “you don’t have access to this right that exists.”

I’ve never especially loved the practice but I’ve done it at work for really sensitive endpoints.