I think the definitive point is that it should be documented. Security through obscurity all by itself isn't security.