&gt; GitHub returns 404 instead of 403 to prevent these information leaks.<p>This behavior is explicitly permitted by the standard, FWIW: <i>An origin server that wishes to &quot;hide&quot; the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found).</i><p><a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc7231#section-6.5.3" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc7231#section-6.5.3</a>