Pages meant to be private are published as public

Checks

• Login or admin page in sitemap or indexable login_or_admin_page_in_sitemap_or_indexable
• Staging or test site public and indexable staging_or_test_host_publicly_reachable_and_indexable
• Account page served without login account_page_served_without_login
• Private page cacheable by shared caches private_page_cacheable_by_shared_caches
• Internal search or export URLs indexable internal_search_or_export_urls_indexable

Findings

• A page that looks private is public, indexable or cacheable

What this relies on

Login, admin, staging and account pages are not meant for search results.

How to verify by hand

Search Console showing these URLs indexed or with impressions.