From d5da64cb7618477b19061eb395caa5fd49fef193 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Wed, 25 Feb 2026 02:34:55 +0100
Subject: [PATCH] =?UTF-8?q?fix(critical):=20filter=20draft=20posts=20on=20?=
 =?UTF-8?q?production=20=E2=80=94=20add=20explicit=20=5Fstatus:published?=
 =?UTF-8?q?=20check?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/blog.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/blog.ts b/lib/blog.ts
index dc441f84..cd0f50c4 100644
--- a/lib/blog.ts
+++ b/lib/blog.ts
@@ -60,13 +60,15 @@ export async function getPostBySlug(slug: string, locale: string): Promise<PostM
   try {
     const payload = await getPayload({ config: configPromise });
 
+    const isDev = process.env.NODE_ENV === 'development';
     const { docs } = await payload.find({
       collection: 'posts',
       where: {
         slug: { equals: slug },
         locale: { equals: locale },
+        ...(!isDev ? { _status: { equals: 'published' } } : {}),
       },
-      draft: process.env.NODE_ENV === 'development',
+      draft: isDev,
       limit: 1,
     });
 
@@ -107,16 +109,17 @@ export async function getPostBySlug(slug: string, locale: string): Promise<PostM
 export async function getAllPosts(locale: string): Promise<PostMdx[]> {
   try {
     const payload = await getPayload({ config: configPromise });
-    // Query only published posts (access checks applied automatically by Payload!)
+    const isDev = process.env.NODE_ENV === 'development';
     const { docs } = await payload.find({
       collection: 'posts',
       where: {
         locale: {
           equals: locale,
         },
+        ...(!isDev ? { _status: { equals: 'published' } } : {}),
       },
       sort: '-date',
-      draft: process.env.NODE_ENV === 'development', // Includes Drafts if running locally
+      draft: isDev,
       limit: 100,
     });