Let me offer a concrete example of the attitude Thomas is referring to: <a href="https:&#x2F;&#x2F;github.com&#x2F;OWASP&#x2F;phpsec&#x2F;issues&#x2F;108" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;OWASP&#x2F;phpsec&#x2F;issues&#x2F;108</a><p>Highlight:<p><pre><code>    Kerckhoff&#x27;s principle applies to cryptography, not
    application security. 
    
          - AbiusX, OWASP project leader for PHP Security
</code></pre>
<a href="https:&#x2F;&#x2F;github.com&#x2F;OWASP&#x2F;phpsec&#x2F;issues&#x2F;108#issuecomment-159689730" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;OWASP&#x2F;phpsec&#x2F;issues&#x2F;108#issuecomment-1596...</a>