What “anyone with the link” should actually mean
Publishing a page is a security decision wearing the costume of a toggle. How Nex mints public addresses, and why one function decides every read.
Every tool in this category has a share menu with a switch labelled something like “publish to web”. It looks like a display preference. It is an access-control decision, and the details underneath it decide whether the phrase “anyone with the link” is true.
The link has to be the secret
If a published page lives at /p/roadmap, then anyone who types /p/roadmap can read it. That is not “anyone with the link”; that is “anyone with a keyboard and an idea”. A word that a person would choose as a page title is a word a stranger would guess.
Nex mints /p/<title>-<10 random characters>. The suffix comes from the platform’s cryptographic random source, never derived from the page id, and it carries enough entropy that guessing is not a strategy. The title stays in front because the address goes into emails and search results where the words matter.
The suffix does a second job people do not expect: it removes the land grab. In a shared readable namespace, the first account to publish “Getting started” owns that address forever and everybody after gets -2, -3, -4. With a random suffix, everyone’s “Getting started” is equally fine.
The address does not follow a rename
Rename a published page and its public URL stays exactly where it was. This surprises people until you say it the other way round: that URL is an address other people are holding, and moving it because you changed a word breaks every link to it.
Unpublishing does not throw the address away either. Re-publish and you get the same URL back, rather than a fresh one that strands whatever already pointed at the old one.
Three audiences, one rule
Publishing is not only on or off. A page can be for anyone with the link, for a list of specific email addresses, or for anyone at a domain. The last one is how you share a handbook page with your company without maintaining a list.
The engineering rule that keeps this honest: one function decides every public read. Not a check in the page query and another in the comments query and a third in the metadata query — one, called by all of them. An access check written twice is a check that eventually disagrees with itself, and the half that is wrong is the half nobody wrote a test for.
The narrow modes compare against the email the identity provider gave us, lower-cased — never a claim from the browser. And the domain check tests that the address ends with @example.com, not that it contains example.com, because me@notexample.com must not get in. That is a one-character difference between a working feature and an open door.
Restricted is told apart from missing — on purpose
Everywhere else in Nex, “not found” and “not yours” are the same answer, because telling them apart lets someone probe for what exists. On a published page we deliberately do the opposite: a reader who cannot see it is told to sign in, rather than told the page does not exist.
That is safe here for the same reason the URL works at all — the address carries the entropy, so whoever is asking already holds it. They were sent it. Telling that person “sign in” is the difference between a colleague getting in and a colleague concluding your link is broken.
The page is live, not a copy
A published page in Nex is the same page. Edit it and the public version has your edit — there is no separate export, no publish step to remember, no stale copy. That is the behaviour people expect from a link they sent, and it is why archiving a page and deleting an account both unpublish first: a page that has stopped existing must stop being readable in the same instant.