Drafts

I was trying out the draft functionality and I noticed that the HTML page that gets added to the Drafts folder is just an iframe that pulls in http://[my site name].blot.im/draft/view/Drafts/[the file name]. And if I open a private browsing window and enter that URL I can see the draft on the public internet. That means that anyone could guess or bruteforce their way to reading my drafts. That seems... not ideal? And definitely makes me wary of storing drafts in the Drafts folder unless I'm just about to publish them.

The title kind of asks the question. I am not a big enough Dropbox user where I have the app on my Mac, so I update all via Git. It works great, outside of the drafts feature. Right now I push a commit and then a minute later I will just do a pull request to get the preview. Is this the best practice to be able to preview or is there a better way?

Most – though not all – of my blog posts, which are written in md, appear to have an html equivalent. The filename is exactly the same, just with the html extension, e.g. filename.md has a filename.md.html twin. What is causing this and what should I do now to clear out the current html files and in the future to stop them appearing in the first place? I'm using Git to sync my posts, if that makes any difference. Thanks.