https://www.theregister.co.uk/2019/01/18/twitter_bug_protected_tweets/

Twitter has fessed up to a flaw in its Android app that, for more than four years, was making twits' private tweets public. The programming blunder has been fixed.

The 280-character social-experiment-gone-awry admitted on Thursday that a bug dating back to November 3, 2014 potentially changed users' "Protect your Tweets" preference – which hides tweets from public view so they are only seen by followers – to publicly visible when a user's email address or other account settings were changed.