TOP EDIT: The solution to the problem can be found in a topic that, at first glance, is about something else (well, it is, but it also solves this problem): http://www.oxwall.org/forum/topic/21385

Specifically, the following:

you will need to comment our or delete following line from ow_plugins/photo/classes/event_handler.php: 
 
$em->bind('feed.before_content_add', array($this, 'feedBeforeStatusUpdate')); 

The line above is just a few before the end of the file. Definitely go to the last page. :)

Original post follows for posterity:

__________________________________________________________________________________________

That is a huge security breach, and non-intuitive to me. If you make a group private, it doesn't show up in the list of groups - that makes sense. It shouldn't. But any content posted to that group should never ever ever leave the group - never ever be visible for anyone not a member of that group (except perhaps admins get universal access).

I've tested on my forum, ieh.im. Created a private group and posted a test photo to the private group, which appears in the public newsfeed album in photos.

How can I fix this? And how can I make sure no other content gets pulled anywhere else?

If there's a topic covering this, please help me find it. I've searched several different keywords, and now I'm going through all the posts manually, which sucks.

Thank you sincerely for any help and advice you have.