Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.
You're right @ggrelot it was overlooked.
Fixed with gerrit #18178