Security: is the entire route map exposed to the clientside, if there is any?

[UltraCakeBakery]

Let's say you have a /secret route with no links pointing to it. Could one through analyzing the final code of the client bundle find that secret route? Is there like a route map which the clientside router has access to?

I can probably figure it out by diving into the code, but maybe someone can explain it in two seconds whereas I would need 2 hours to be at least unsure, lol.

[teemingc]

Yes, the route map is exposed in the _app/immutable/chunks/entry/app.js file.
See #10072