I believe this is a version 2.2 bug.
I’ve made a password protected post for testing.
Many of my friends told me that they can read the content through RSS reader, Bloglines, Google reader, Netvibes.
Isn’t the post suppose to be “protected”?
Man, I’m getting frustrated.
which wordpress version do you use?
In version 2.2, go to /wp-includes/post-template.php,
you will find the line there.