I didn't say it was perfectly accurate, just that it was the best.

So your argument is that a better way to check this is to crawl the entire web looking for links to a resource to determine if it was meant to be publicly accessible?

> Given the numerous articles about documents inadvertently being exposed through URL ID incrementing, clearly response codes do not accurately convey what people meant.

Your intent argument is really shallow. People do bad things with good intentions all the time. Doesn't mean their actions are good or legal.