Steal Like an Engineer

GitHub answers 404, not 403, for private repos, so it never confirms they exist. When to return 404 instead of 403, and how to check your own app.