And indeed the spec for 403 (Forbidden) includes 404 as a valid return code if you do not wish to reveal the fact that there's anything there: An origin server

And indeed the spec for 403 (Forbidden) includes 404 as a valid return code if you do not wish to reveal the fact that there's anything there: An origin server that wishes to "hide" the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found).