[MM3-users] Unadvertised lists accessible even if not signed in

Hi folks, I'm running Mailman3 3.3.10, with postorius and hyperkitty. I want unadvertised lists to be visible only to the people who are subscribed to them and to site administrators.

Right now, anyone who has the name of a list can construct a URL to the signup page, even for unadvertised lists.

So, I can go to: https://site.name/postorius/lists/test.site.name/ and get to the test list, even if it is unadvertised. I see people scanning URLs like this in the NGINX logs, looking for lists.

How can I prevent anyone not logged in, and not a member of an unadvertised list, from seeing it?

Peter C