A friend of mine has a password protected blog that I don't have the password too. She turned on the password after I'd subscribed via RSS.
I recently updated my RSS feed for her blog, and all her posts were visible to me.
This is a serious privacy hole - can you fix it please?