diff --git a/site.lua b/site.lua
index 628d19a9..adbae965 100644
--- a/site.lua
+++ b/site.lua
@@ -232,6 +232,7 @@ app:match('project', '/project', capture_errors(function (self)
         self.params.projectname
     )
     assert_project_exists(self)
+    assert_can_view_project(self)
 
     -- check whether this is a remix of another project
     local remix =
diff --git a/validation.lua b/validation.lua
index f7ab9d36..530c9cc8 100644
--- a/validation.lua
+++ b/validation.lua
@@ -294,6 +294,15 @@ assert_project_exists = function (self, project)
     return proj
 end
 
+assert_can_view_project = function (self, project)
+    local proj = self.project or project
+    if (not proj.ispublished and not proj.ispublic
+            and not users_match(self) and not self.current_user:isadmin())
+    then
+        yield_error(err.nonexistent_project)
+    end
+end
+
 -- Tokens
 
 check_token = function (self, token, purpose, on_success)