You can now run a private (password protected) blog with Ghost.
Private blogs are great for when you just want your friends and family to have access to your posts, you want to run an internal company blog to share information between team members, or you're just in the pre-launch phase.
This feature is NOT actually meant for private blogs.
It leaks your feature photos and Ghost @staff have stated that it is actually intended as a “coming soon” feature to protect your blog from viewers until it’s ready to be public. It should NOT be trusted to protect your content (at very least the feature photos of your posts).
tl;dr In other words, it is only intended for a “prelaunch phase”, NOT to protect a private friends and family blog or a sensitive internal company blog.