Ambiguity in Sass module privacy: relying on naming conventions vs explicit @forward show lists

When using the Sass module system with @use, members are public by default unless they begin with a hyphen or underscore. Teams can also control exposure through a central entrypoint that uses @forward with explicit show lists to re‑export only intended members. The project must decide whether to rely solely on the naming‑based privacy mechanism, to adopt the explicit show‑list approach, or to combine both, considering factors such as maintainability, tooling support, and the risk of accidental public exposure.

Which strategy provides the clearest guarantee that internal helpers remain inaccessible to downstream stylesheets while keeping the public API surface minimal and easy to audit?