A product can say “private by default” and still expose information through a forgotten API, a public profile, or an indexing route. Privacy is preserved only when every access path enforces the same boundary.
The API lesson
Atlassian said public Trello profile data obtained through API misuse in January 2024 was later released. Its public explanation is a reminder that a feature intended for one useful action can create a broad collection path. Privacy defaults must survive that path, not merely the main screen.
Every route is part of the boundary
Pages, JSON responses, search helpers, sitemap entries, profile summaries, and attachments all need the same answer to one question: may this requester receive this record? A hidden button or unlinked URL is not authorization. Guessable identifiers are not a privacy feature either.
Publication is a command
Inpages does not turn a Memory public through ordinary autosave. A dedicated authenticated publication command checks ownership, rejects stale changes, requires Standard protection, and synchronizes search eligibility with the owner's Publisher mode. That keeps a malformed update from treating visibility as incidental editor state.
Public and indexed are different
A public Memory can be readable at its canonical URL while still being noindex and excluded from the sitemap while Publisher mode is off. Turning that account-level mode on is a separate, explicit search-discovery decision. The private and public trust-boundaries note describes the full state model.
Protected content has no public state
A Protected Memory cannot be published. An anonymous reader would need the owner's Master Key to render it, and distributing that key would defeat the protection model. The system instead requires an explicit transition back to Standard protection before a separate publication decision.
Test the negative cases
The highest-value checks request a private record by a guessed route, inspect the sitemap with Publisher mode on and off, apply a moderation exclusion, and attempt to publish an encrypted one. Tests should prove denial as carefully as they prove the happy path. The browser encryption test strategy explains how those state boundaries are exercised.