New pages silently unprotected: allowlist matcher protects listed routes only

TL;DR: A route you assumed was protected is reachable signed-out. The middleware lists protected paths, so every route you add later is public by default until someone remembers to list it. Confirm the cause 1. Read your middleware.

The fix

1. Read your middleware. If it says if (isProtectedRoute(req)) { await auth.protect() } with a list of protected paths, you have an allowlist. New routes are born unprotected.
2. Audit: pick three routes you believe are protected and request them with no session. Any 200 on a page that should require auth confirms it.
3. Invert the check: list only public routes, protect everything else.
4. After inverting, re-audit the same three routes plus every route added in the last month.
5. Keep server-side auth() checks inside route handlers and server components as a second layer; the middleware is not the only gate.
6. This covers exactly what the title says: New pages silently unprotected.
7. You are setting this up for the first time, or auditing an existing setup.
8. You want the key gotchas in one place before you start.
9. You are doing a different workflow with New; these steps are specific to the title above.
10. You need the full reference docs; this is the short path, not the manual.
11. Not pinned to a specific version; follows current New behavior.

When to use this

• This covers exactly what the title says: New pages silently unprotected.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with New; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Verified 2026-09-26: a Clerk middleware advisory record documents this exact shape, naming the isProtectedRoute allowlist as the bypassable pattern and the inverted isPublicRoute check as the correct one, with server-side auth() checks as defense in depth.