Security through (or by) obscurity is a strategy in web application development that assumes a hacker can't hack what he can't see; even if a vulnerability exists, as long as it's appropriately hidden or obfuscated, it'll never be discovered and used for malicious purposes.
While this can feel true (how could someone find this thing I've cleverly hidden—I've cleverly hidden it), it ignores a basic understanding of computers and programming. Computers are great at finding needles in haystacks. And it's not just one person programming one script on one machine who's interested in probing your site for vulnerabilities; any site exposed to the internet faces a 24/7/365 crowd-sourced attempt to compromise its network. When you assume that no one will find your hidden exploit, you're actually...
