My whole point was that you should choose your <i>404</i>s in a way that doesn&#x27;t allow 403s to give away information.<p>For example, on Github we know that a user is at github.com&#x2F;username, we also know that whether or not a user exists is public information. So if we GET github.com&#x2F;nonexistantuser, that should return a 404.<p>A user&#x27;s repo, however is <i>not</i> public information, so when a request is made to github.com&#x2F;username&#x2F;nonexistantrepo that should return a 403, unless you have privileges to know that information, if you were, for example that logged in user, only THEN should you give the 404.