Probably baked as a static site, uploaded to an object-storage bucket, fronted with a CDN. Object storage providers (first AWS, but then copied elsewhere) serve

Probably baked as a static site, uploaded to an object-storage bucket, fronted with a CDN. Object storage providers (first AWS, but then copied elsewhere) serve 403 instead of 404 when an object doesn't exist in the bucket, to truly hide objects that users don't have access to, by making "unauthorized" indistinguishable from "doesn't exist."