> FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. I would totally open an unmarked unlocked door in a public space that h

> FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. I would totally open an unmarked unlocked door in a public space that has locked doors clearly marked "restricted access", especially if the layout of the place I'm visiting suggests that there would be something interesting there. That's pretty much what it boils down to, no? Just because you didn't document an endpoint doesn't necessarily mean it's restricted access. In fact, if the end point is accessible, and you have other sections of your service that require authentication, then it's very much the exception that proves the rule — the fact that you specifically forbid access to some routes reasonably means that, in general, I'm allowed access to unauthenticated endpoints.