The rules (which are available online) do specify that hands are secret. This is within the setup section:
Shuffle the remaining deck and deal 4 cards face down to each player.
Deal 1 Defuse card to each player so that everyone has a hand of 5 cards total. Keep your hand secret
The draw step is part of the normal turn order:
- Finally, end your turn by drawing a card from the Draw Pile into your hand and hoping it’s not an Exploding Kitten.
So the game tells us that hands are secret and cards drawn are added to our hand - at no point does it tell us to reveal the drawn card.
The exception for an exploding kitten being revealed immediately is covered under the specific rules for exploding kittens:
EXPLODING KITTENS
You must show this card immediately. Unless you have a DEFUSE CARD, you’re dead. Discard all of your cards, including the EXPLODING KITTEN.
So yes, you trust people to admit when they have a kitten. Cheating is possible (i.e. hold a kitten, then steal a defuse and pretend the next card was a kitten), but apart from that specific case it won't stop them being found out by the end of the game.