Fetch junochen.com/what-do-you-count.html with no password. It returns 200 with the complete essay, figures included, before the password prompt renders. The check is client-side; the server hands the document to anyone who requests it. I ran it this morning, so this is verified, not inferred.
Inside that HTML: TinyFish by name, your CEO and CPO in the room, step-based billing rationale, the unified credit architecture, the 30-day task success rate, your read on four competitors. All of it internal-only.
The evaluators most drawn to your trust work — Rubrik, Altana, HackerOne — are the ones who open page source. A decorative lock on a portfolio arguing that trust depends on real authority and control is a mismatch they register before the first call.
Pull the homepage link today. Ship a server-side gate before the Trust Pattern Library goes live and starts pulling traffic to the site.
Who already has it: Slack, iMessage and LinkedIn link previews. Crawlers. curl. Anyone who opens view-source. None of them run your password check.
Not a fix: stronger "Private Essay" labeling, a redesigned overlay, rewritten gate logic. Each still ships the full document to the requester.
The fix: the URL returns 401 or 403 to unauthenticated requests, before any page code loads.
The five-minute version: delete the "Read →" link from Field Studies on the homepage. Doesn't close the URL. Does kill the navigation path and the preview unfurl.
Open since June 30: confirmed in six consecutive audits, including today's.
Second exposed file: uat-sentinel-demo.html sits in your homepage source, outside your external lab set (Brand Pulse, Retail Velocity, Carrier IQ). Same fix, lower priority.