a public read that can see only what was published

The public marketplace needed to show, for every venue, a small card of near-live facts: a rating, a delivery fee, an arrival estimate. The obvious implementation is a query — the page asks the database whatever is true right now. The implementation that shipped is a projection. Each venue's catalog is published as a versioned snapshot, the public read serves the latest published row and nothing else, and the history underneath stays append-only so a superseded or withdrawn version can never resurface through a read path nobody remembered to update.

Withdrawal is the interesting half. Taking a venue down does not delete rows; it sets a flag, the landing read filters on that flag, and a partial index keeps the filter cheap. Withdrawing something already withdrawn returns not-found rather than performing a second write. Missing fields are refused uniformly before anything is stored, so a half-formed publication cannot exist to be debugged later.

The intent is that the outward surface can only ever see what someone deliberately published, in the shape it was published, and that the visible set is a decision recorded in the data rather than a query someone happened to write. Then the security review read the same surface and found the other half missing: the publish and withdraw routes had no authentication in front of them. The boundary was carefully built and left unlocked.

That is the honest version of a common failure. The semantics of exposure had been thought through in detail; the authorization in front of them had not been thought about at all. What it proves is that this platform can build a narrow public boundary — and that narrowness is worth nothing until access to it is closed.