Sankofa Journal Step 10: Locking It Down

Restrict editing and deleting to the post's author. Do it by filtering the query rather than checking afterwards. Then attack your own site: sign in as one account, note the id of a post you own, sign in as a second account, and type the edit URL for that post directly. You must not be able to edit it. Also confirm that an unpublished post is invisible to everyone but its author. Hide the buttons too, but only after the view is already safe without them.