I'm looking for any advice on best practices for creating placeholders in the tree that contain things like selectors, or even assets that should be accessible by end users, but not necessarily browseable.
In my tree, I have a "Selectors" placeholder, underwhich I have various categories of Pages used for selector values. Should I have this marked as hidden and/or unpublished to keep it from appearing in any brute-force url attempts? I'm pointing directly to the specific selector tree when defining my fields, but I'm not sure what ramifications the upper selector's visiblity will have.
I guess the underlying question is how are those attributes inherited/passed down to children? I know in my searches I can specify to include hidden pages, but if I start my search underneath will I also need to include that? Is this behavior explicitly defined, or currently just a "that's the way it is as an artifact of the way things are designed" that may accidently change at some point?
I think a follow up question to this is, how do I best test my site for vulnerabilities/leaked information that's not locked away?
Thanks as always!