A developer discovers that their application's admin page is not linked from any public UI but is accessible at /admin. A user finds it by guessing the URL. What security principle does this violate?

• A.Security through obscurity is not a valid access control: hidden URLs without proper authentication and authorization checks are not protected. An attacker using directory enumeration tools or guessing common paths will find them
• B.Separation of duties is violated: administration and public browsing were served from one application server and one domain - a design that rules out any role-based check on the admin page from the start in the production network of the company
• C.Input validation is violated: the server accepts an unnormalized path from the address bar and routes it to the handler before the session check runs and before logging starts - a gap that lets a guessed URL reach the admin page without a login check
• D.Fail-safe defaults are violated: the admin page was published without a redirect from the public site and a robots.txt entry was missing for the search engines that indexed it