That's right - can't edit or view the code when private (unless you're a member of the project) but you can always see the published project. But of course, you can implement whatever access controls you want in your app.