The Search API plugin returns private posts and comments in the results. Seems like a huge oversight. I'm using it with the MySQL plugin.
When I click on one of the results, I correctly get a 'nothing here' error. However, the results page, displays the titles and first line or so of the private post.