I know that unpublished worlds don’t appear in the catalog, but can someone still find them if they know the URL? (So, for example, if a creator announces the name of their world before it’s ready, people could peek?)
Well, short answer: yes. Unpublished worlds are, as far as I can tell, fully playable through the URL.
This is the case, but you can always append a number to your world domain until it’s ready, making it basically unguessable; and lock all content behind a quality only you control, so even if someone finds it they can’t get at anything.
The Key of Dreams is an awesome gatekeeper.