I hear a version of this reasoning constantly, and it's rarely stated quite this bluntly, but it's almost always the actual belief underneath: "that page isn't linked anywhere, nobody would ever find it." It's a comforting thought, and it's built on a real but narrow truth that doesn't extend nearly as far as it needs to.
What obscurity actually protects against
An unlinked page genuinely is safe from someone casually browsing your app and clicking around. A regular visitor has no reason to type a random-looking URL, and won't stumble onto it by accident. Against that specific, low-effort kind of looking, obscurity works exactly as well as it feels like it should.
What it doesn't protect against
Anyone deliberately probing an app, whether out of curiosity, malice, or simply running an automated tool that tries common patterns, isn't limited to clicking visible links. Tools exist specifically to guess and enumerate URLs, search engines index pages that were never meant to be found, and a determined person can often infer a hidden page's address just from how the rest of the app is structured. None of that requires the page to be linked anywhere at all.
Why this myth persists despite being easy to disprove
Most people's day-to-day experience of a hidden page really is "nobody found it," because most people looking at most apps aren't looking very hard. That experience feels like proof the approach works, right up until the one time someone actually is looking hard, at which point the entire protection turns out to have been an assumption about visitors' effort level, not an actual barrier.
How to check whether you're relying on this without realizing it
- List every page or route in your app that has no explicit login or access check, regardless of whether it's linked anywhere visible.
- For each one, ask honestly: if someone found this URL right now, logged out, what would they see?
- If the answer relies on "they'd have to know the exact address," that's obscurity doing the work a real check should be doing instead.
Obscurity is a fine bonus layer on top of a real access check. It has never once, on its own, been an actual substitute for one, and treating it as sufficient is exactly the gap that turns "nobody would look" into "someone eventually did."