Security by obscurity is relying on hidden details-such as an unlisted URL, hard-to-guess token, or undisclosed system design-to keep a resource safe. These measures may reduce casual discovery, but they do not verify who is accessing the resource or stop access if the secret becomes known.
In cyber security, obscurity can be a useful extra layer, but not a substitute for authentication and access controls. A bearer link may be exposed through logs, referrers, scans, or passive DNS records, making a supposedly private page discoverable. Defenses include requiring recipient sign-in, limiting permissions, setting expiration, and supporting revocation. Treat links as potentially public unless access is independently restricted.