Lock a report filter

A report or page filter can now limit what public links and embeds can read, enforced on the server. Unlocked filters still only shape the page.

Report and page filters now have a Lock switch. Halo adds a locked filter on the server to every query from a public link or embed, and to PDFs and snapshots of the published report, so it holds even for someone calling the API.

An unlocked filter works as it always has: it shapes what the page shows, and someone with the link can still read other values of the fields in scope.

If you share a report with a filter that's meant to keep data back, check it. Filters already in your reports stay unlocked until you lock them and publish again. Halo won't publish a locked filter it can't enforce, and says which one. See Locked filters.