you never know if these are all URLs tho, so I would always crawl and brute force more paths than trusting sitemap.xml