diff --git a/marko/page/story/components/story-menu/index.marko b/marko/page/story/components/story-menu/index.marko
index 53810d3..d0ae65b 100644
--- a/marko/page/story/components/story-menu/index.marko
+++ b/marko/page/story/components/story-menu/index.marko
@@ -1,6 +1,7 @@
 <menu user=input.user>
   <menu-header>Story</menu-header>
   <menu-link key="index" selected=input.selected.index icon="S" href="/story/">Stories</menu-link>
+  <menu-link if(input.user.loggedIn) key="unlisted" selected=input.selected.unlisted icon="S" href="/story/unlisted/">Unlisted</menu-link>
   <menu-link selected=input.selected.tags icon="T" href="/story/tag-list/">Tags</menu-link>
   <menu-gap if(input.menuAuthor || input.menuMonth || input.menuTags) />
   <if(input.menuMonth != null)>
diff --git a/middleware/locals.js b/middleware/locals.js
index 9131f1b..d537063 100644
--- a/middleware/locals.js
+++ b/middleware/locals.js
@@ -3,7 +3,7 @@ const config = require("../config")
 module.exports = (req, res, next) => {
   if (res.marko) {
     res.markoAsync = async(template, input) => {
-      const locals = Object.assign((res.locals || {}), input)
+      const locals = Object.assign({}, (res.locals || {}), input)
 
       try {
         for (const key in locals) {
@@ -12,7 +12,7 @@ module.exports = (req, res, next) => {
             locals[key] = await value
           }
         }
-
+        
         if (locals.user.permissions != null) {
           locals.user.permissions = await locals.user.permissions
         }
diff --git a/routes/story/unlisted.js b/routes/story/unlisted.js
new file mode 100644
index 0000000..f82f04d
--- /dev/null
+++ b/routes/story/unlisted.js
@@ -0,0 +1,33 @@
+const jwt = require("jsonwebtoken")
+const express = require("express")
+const router = express.Router()
+
+const common = require("./common")
+const config = require("../../config")
+const {storyApi} = require("../../rpdata/api/Story")
+
+const listTemplate = require("../../marko/page/story/list.marko")
+
+router.get("/", common, async(req, res) => {
+  if (!res.locals.user.loggedIn) {
+    return res.status(401).end("You are not logged in")
+  }
+  
+  try {
+    await res.markoAsync(listTemplate, {
+      stories: storyApi.list({unlisted: true, author: res.locals.user.name}, {token: generateToken(res.locals.user.name)}),
+      selected: {unlisted: true},
+    })
+  } catch(err) {
+    console.error(err)
+  }
+})
+
+/**
+ * @param {string} user 
+ */
+function generateToken(user) {
+  return jwt.sign({user, permissions: ["member"], exp: Math.floor((Date.now() / 1000) + 1200)}, config.backend.secret, {header: {kid: config.backend.kid}})
+}
+
+module.exports = router
diff --git a/rpdata/api/Story.js b/rpdata/api/Story.js
index 726a82a..fdd8e3d 100644
--- a/rpdata/api/Story.js
+++ b/rpdata/api/Story.js
@@ -54,7 +54,7 @@ const storyApi = {
    * @param {{author:string, category:string, tags:Tag[]|Tag, unlisted: boolean, open: boolean, earliestFictionalDate:Date|string, latestFictionalDate:Date|string, limit:number}} filter 
    * @returns {Promise<Story[]>}
    */
-  list(filter = {}) {
+  list(filter = {}, options = {}) {
     if (filter.earliestFictionalDate != null && typeof(filter.earliestFictionalDate) !== "string") {
       filter.earliestFictionalDate = filter.earliestFictionalDate.toISOString()
     }
@@ -80,7 +80,7 @@ const storyApi = {
           updatedDate    
         }
       }
-    `, {filter}).then(({stories}) => {
+    `, {filter}, options).then(({stories}) => {
        return stories.map(d => new Story(d.id, d.name, d.author, d.category, d.listed, d.open, d.createdDate, d.updatedDate, d.fictionalDate, d.tags))
     })
   },
diff --git a/server.js b/server.js
index d8967c1..3d39bad 100644
--- a/server.js
+++ b/server.js
@@ -81,6 +81,7 @@ app.use("/playground", proxy(config.playgroundEndpoint))
 
 // Page routes
 app.use("/story/", require("./routes/story"))
+app.use("/story/unlisted/", require("./routes/story/unlisted"))
 app.use("/story/by-category/", require("./routes/story/by-category"))
 app.use("/story/by-tag/", require("./routes/story/by-tag"))
 app.use("/story/by-month/", require("./routes/story/by-month"))