diff --git a/app/controllers/public/base_controller.rb b/app/controllers/public/base_controller.rb
index b4c33e95b..018b1ab36 100644
--- a/app/controllers/public/base_controller.rb
+++ b/app/controllers/public/base_controller.rb
@@ -11,7 +11,7 @@ class Public::BaseController < ApplicationController
     end
 
     def set_card
-      @card = @board.cards.find_by!(number: params[:id]) if params[:board_id] && params[:id]
+      @card = @board.cards.published.find_by!(number: params[:id]) if params[:board_id] && params[:id]
     end
 
     def set_public_cache_expiration
diff --git a/test/controllers/public/cards_controller_test.rb b/test/controllers/public/cards_controller_test.rb
index 652da3e8a..8b3b9e029 100644
--- a/test/controllers/public/cards_controller_test.rb
+++ b/test/controllers/public/cards_controller_test.rb
@@ -18,4 +18,10 @@ class Public::CardsControllerTest < ActionDispatch::IntegrationTest
     get public_board_card_path(@board.publication.key, @card)
     assert_response :not_found
   end
+
+  test "not found if the card is drafted" do
+    @card.update!(status: :drafted)
+    get public_board_card_path(@board.publication.key, @card)
+    assert_response :not_found
+  end
 end