I often have people test my unpublished games in DRAFT mode by sharing the "secret" URL that the game page will generate in draft mode.

I've never thought about this, but wanted to make sure: visiting an itch page with a secret URL only allows the user to play the game and not edit the page nor the theme nor change anything, correct? I assume they'd have to be logged in as me to make changes. The wording that's confusing is "Only those who can edit the project can view the page" but I've shared that URL with people for testing and they can indeed view the page. Is the secret URL also giving them access to edit the project and I'm not aware of this?

Should I be using "restricted" access and a password for this type of thing instead?