In recent months I have come across several sites, which give a 404 status/error page, when there should be 403 or maybe 401.
For example, I have a private repository on github.com with link:
When I accidentaly logged out and tried to reach this link, I only got "This is not the page you are looking for" message, which is obviously not true. I AM looking for it and the resource DOES exist, I am just not authenticated. I would expect a 403 or some other "permission denied" page. This one really scared me for a few seconds, because it implied my repository was deleted.
Do you also consider this to be wrong? What would be the "best practice" in this area?