About a week ago I thought I’d discovered a bug in WordPress. After logging out, I found that the feed continued to show posts marked as private. This turned out to be a hit on a stale browser cache. Meh. But it also goes to show that all the warnings about “clearing browser cache” are truth, after all.
I also thought it was a bit funny how/why feeds reflect private posts even though there is just one feed URL (unlike some other web apps; e.g. Springpad). It turns out that WordPress content (e.g. feeds) is served up based on the permissions of the logged-in user. So there may be three versions of content. One for anonymous users, one for logged in users (w/ access) and one for logged-in users (w/o access).
So there you go, mystery solved. Heh