Rule 7 of 12 · Chapter II — Designing for Disclosure

Count obfuscation, undocumented formats, and hidden endpoints as delay you add on top of security, never as part of the security budget.

Why this rule exists

Obfuscation has real value: it costs an attacker hours or weeks and it filters out opportunists. What it cannot do is survive one determined analyst, one decompiler, or one leaked internal document — and the moment it falls, anything that was resting on it falls too. The failure mode is not the obfuscation itself but the accounting, where a hidden endpoint quietly becomes the reason a check was never written.

In practice

For each secret-ish measure, ask what breaks if an attacker knows it tomorrow. If the answer is anything beyond 'they save some time,' you have a dependency and you need a real control underneath it: authentication on that hidden endpoint, authorisation on that undocumented format. Keep obscurity measures out of threat-model risk reductions and name them as friction in the design document.

When it doesn't apply

Where delay is itself the goal — slowing mass automated scanning, buying time for detection and rotation — obscurity is a legitimate tactic to deploy deliberately and measure as such.