Skip to main content

Indie game storeFree gamesFun gamesHorror games
Game developmentAssetsComics
SalesBundles
Jobs
TagsGame Engines

Games in Draft mode can be discovered by guessing URLs. This should not be possible.

A topic by Escape Character created Mar 07, 2023 Views: 585 Replies: 3
Viewing posts 1 to 4
(+1)

Expected Behaviour:

If you have a "draft" game, that you've never published, someone who is not you should not have access to it, or should be even aware it exists, even if they know the URL. Right now, if you go to a URL for which you do not have access, e.g.  https://escapecharacter.itch.io/made-up-game  , it shows a 404 page and no indication whether there is a game in draft or not.


Current Behaviour:

If you go to a URL for a game which is in draft, it shows a 404 page, but the title of the page is taken from the draft. This lets people guess what games people are working on an view their titles before they were intended to be released.

e.g. go to https://escapecharacter.itch.io/blunt-quaternion, for which I have a draft game, you can see the "title" of the page has the game name. As opposed to the "Expected behaviour" above, where the title is just itch.io

FYI - This game may be published by the time you read this post, but you can verify this behaviour yourself.


Moderator

This is actually a very clever find!

I can verify that I could reproduce this issue with the URL you’ve posted above.

Admin(+1)

Nice find, it looks like this regression happen about a month ago. The issue is now fixed. Thanks for reporting.

 🧙‍♂️🕵️