Blog posts marked as feed-hidden were behaving inconsistently for brand owners. The human-readable view loaded fine, but switching to agent view returned a 404 — the agent page had a visibility gate that didn't account for the owner being allowed through. Feed-hidden posts are now correctly reachable in agent view by the owner, since is_public is the master gate for access; hiding a post from the feed doesn't revoke agent access.
The owner bypass itself had a deeper problem. The helper used to identify the logged-in owner was only decoding the JWT, not verifying its signature — and because these pages sit on public routes that middleware skips, a forged token would have passed the check and exposed private blog content. The owner check across the blog post pages now uses the verified token helper.
A lint rule has been added to catch any future use of the unverified call inside public route groups, so this pattern can't quietly reappear.