Unpublished content is accessible in front-end

[perrydrums]

Package containing the bug

I’m not sure

Describe the bug

After following the guides on https://next-drupal.org/learn/preview-mode, I can access all content regardless if they are published or not. This has to do with the Bypass Access Control permission, but this has to be added according to the guide. I expect to only be able to visit those pages when on preview mode. (I tried incognito mode and made sure preview mode was turned off)

Expected behavior

Visiting unpublished content /blog/test-article results in a 404, except when in preview mode.

Am I doing something wrong?

Is there something I don't understand here? I followed the guide and installed the GraphQL starter projects.