Once a path is visited in preview mode, it is available to public.

[kyashrathore]

I have a preview mode url "/api/preview?secret=token&path=/posts/id"

when I visit it first time with preview mode on, getStaticProps is called and I receive a page with update data in draft, that is completely fine.

But now any one can visit /posts/id and see what I am upto?

Probably because page generated for preview only is stored on disk.

[c0b41]

no preview mode only work with cookie

[kyashrathore]

The resulted page is written on disk as all other page as posts/id.

They are is no question of cookies, cookies are not required for posts/id path.

Please read again what I am trying to say.

There is a path posts/id/ still in draft so I want to access this in preview mode so I called /api/preview?secret=''&slug=posts/id.

Now getStaticProps gets called and writes the html output on disk on posts/id path, and anyone can access it.

[timneutkens]

Could you create a minimal reproduction and open an issue, then we can investigate 👍

[kyashrathore]

Sure will do