This question already has an answer here:
I am developing a web app which currently does not have authentication/authorization mechanism. But I still want to add an admin url from which I can add content. The admin url is not revealed to users and is hard to guess (a url like
/mysupersecretadmin) but it does not have any authentication. So anyone who has the url, can post stuff to the app.The app uses https exclusively.
I'm wondering how insecure is this practice?