I just found this topic after a client called me saying posts set as Private are showing up on their website. So is the relationship field really just showing all posts, regardless what status they have? This should never happen! A private post means it’s only meant for logged in users and not for anyone else!