New pages silently unprotected: allowlist matcher protects listed routes only

Symptom

A recently added page or API route is accessible without signing in, while older routes are protected.

Confirm the cause

1. Read your middleware. If it says if (isProtectedRoute(req)) { await auth.protect() } with a list of protected paths, you have an allowlist. New routes are born unprotected.
2. Audit: pick three routes you believe are protected and request them with no session. Any 200 on a page that should require auth confirms it.

Fix

• Invert the check: list only public routes, protect everything else.

  const isPublicRoute = createRouteMatcher(['/sign-in(.*)', '/sign-up(.*)', '/'])
  export default clerkMiddleware(async (auth, req) => {
    if (!isPublicRoute(req)) { await auth.protect() }
  })

• After inverting, re-audit the same three routes plus every route added in the last month.
• Keep server-side auth() checks inside route handlers and server components as a second layer; the middleware is not the only gate.

Verify

Request every route in your sitemap signed-out. Protected pages redirect to sign-in; only the public list returns 200.

Verified 2026-09-26: a Clerk middleware advisory record documents this exact shape, naming the isProtectedRoute allowlist as the bypassable pattern and the inverted isPublicRoute check as the correct one, with server-side auth() checks as defense in depth.