In SPA all defined routes is stored into client, so all client can get instance from devtools, example vue :

const app = document.getElementById(vue_element).__vue__

from that app instance, client can get all routes from :

app.$router.options

even i use Navigation Guards, example i use beforeEach. client still can bypass and access the routes like this

app.$router.beforeEach = null
app.$router.beforeHooks = null
app.$router.push(route_path)

i know client still can't get data from api server.

but i still want to know for this solution.