Status: In Review
Affects Version/s: 0.9.165
Fix Version/s: None
1. Log in
2. Browse > Collections > New Collection
3. Fill in required fields
4. Check "This collection is unrevealed"
6. Follow "Post to Collection" link on the collection's page
7. Fill in required fields
The work will have a "This work is part of an ongoing challenge and will be revealed soon!" banner at the top, but you'll be able to see the work and the download links because you're the creator.
Copy one of those download links and try it in another browser where you're logged out or logged in as someone else – or have a friend try the link.
Surprise! The work downloads. It will also download if the creator or the challenge owner, who are both able to see the work and its download links, click the download link.
(The good news is you need to know the title and the creator of the work or have someone give you the download link directly, so it's not super easy.)
What should happen
You should get a flash message saying "Sorry, you can't download an unrevealed work" and you should be directed to the /works page. Really! It says so right in the code: https://github.com/otwcode/otwarchive/blob/master/app/controllers/downloads_controller.rb#L23
Update 5 November 2017
On production, it is no longer possible to download an unrevealed work, yay! However, even though you're redirected to the /works index, you don't receive an error message, so that's a bit of a problem.