A founder running a small private beta told me, with real confidence, that it wasn't publicly discoverable: "I've only ever sent that link directly to the ten people testing it." He was right that he'd never posted it anywhere. He was wrong about what that actually meant.
The gap between "I didn't share it" and "nobody can find it"
A URL isn't private just because you personally never posted it in public. If a page is reachable without logging in, search engines can and do find it, sometimes through a link in an email client's preview, a testing tool that crawled it, a browser extension, or simply by discovering it linked from somewhere else entirely unrelated to how he'd shared it. None of that requires him to have done anything wrong. It just requires the page to have been technically reachable, which it was.
What we actually found
A quick search for a distinctive phrase from his beta's landing page turned up the page itself, indexed and visible, along with a couple of internal pages one click deeper that definitely weren't meant to be browsed by a stranger who found it through a search engine rather than through his invite process.
He never shared the link publicly. The internet found it anyway, because nothing was actually stopping it from being found.
Why this happens more often than people expect
"Private" often means "not something I've advertised," which is a social claim about your own behavior, not a technical claim about who can reach the page. Actual privacy requires an actual technical barrier: a login requirement, an access code, or explicitly telling search engines not to index the page. Without one of those, reachability and discoverability are both wide open regardless of how quietly you thought you were operating.
How to check your own "private" pages
- Search a distinctive phrase or heading from your supposedly private page in a search engine, in quotes, and see if it turns up.
- Try opening the page's URL directly in a fully logged-out, private browser window.
- If it loads without asking you to log in or enter a code, it isn't actually private, regardless of who you've shared the link with.
He added a real access requirement that same day. The lesson that stuck with him, and worth sitting with here too, is that "nobody would think to look" was never actually true. Search engines don't need a reason to look, they just need a page that's reachable.