Kerckhoffs's Principle

If

A cryptosystem should remain secure even if everything about it except the key is public. Secrecy of the algorithm is brittle: mechanisms leak, get reverse-engineered, and get reused across systems.

Then

Assume the attacker has your source and design. Put all of the secret in rotatable keys, and never rely on a hidden algorithm to protect anything.

Unless

Defense in Depth — obscurity may be one thin extra layer, never the foundation