Yes, and also post-commit url's should not be visible to everyone, as this can provide someone the data which can be used to spam ci server with jobs for example. I don't know how important is smalltalkhub anyway.
When you look at someones page you can read commit messages of packages that belong to a private project. You can't see the project nor the package but it is listed in recent activities. I filed a bug