Post

We have sorted this out. The module didn't show up in the search results but on papernoises profile page.
That was not a bug but an intended behavior, because private and duplicate modules historically share the same tag.
Nevertheless I have uploaded a patch where private/duplicate modules are hidden on users profile pages now.
Also private module pages have received a robot noindex meta tag to exclude them from search engines.

As long as private modules are not assigned to public racks they should be pretty much stealthy now.
You can still link to them so we are not talking about bulletproof protection, though.