Well, I don't think your idea is very good either. You are basically doing security through obscurity by not reveling your mitigation methods. Sure they can thr

Well, I don't think your idea is very good either. You are basically doing security through obscurity by not reveling your mitigation methods. Sure they can throw off many attackers but any dedicated one will eventually find vulnerabilities (especially if they are state actors). If you have some mitigation techniques available, you will be able to block many attacks while providing a good guideline what your software does not do and encourage "white hacks" to come up with better mitigations.