diff --git a/src/registry.py b/src/registry.py
index 8519a6f66..1bce02c13 100644
--- a/src/registry.py
+++ b/src/registry.py
@@ -252,7 +252,9 @@ class Group(object):
         if not isValidRegistryName(name):
             raise InvalidRegistryName, name
         if node is None:
-            node = Group()
+            node = Group(private=self._private)
+        else:
+            node._private = node._private or self._private
         # We tried in any number of horrible ways to make it so that
         # re-registering something would work.  It doesn't, plain and simple.
         # For the longest time, we had an "Is this right?" comment here, but
diff --git a/test/test_registry.py b/test/test_registry.py
index fb43c5572..b59f02daf 100644
--- a/test/test_registry.py
+++ b/test/test_registry.py
@@ -199,4 +199,29 @@ class ValuesTestCase(SupyTestCase):
             self.assertEqual(v(), 'bar')
         self.assertEqual(v(), 'foo')
 
+class SecurityTestCase(SupyTestCase):
+    def testPrivate(self):
+        v = registry.String('foo', 'help')
+        self.assertFalse(v._private)
+        v = registry.String('foo', 'help', private=True)
+        self.assertTrue(v._private)
+
+        g = registry.Group('foo')
+        v = registry.String('foo', 'help')
+        g.register('val', v)
+        self.assertFalse(g._private)
+        self.assertFalse(g.val._private)
+
+        g = registry.Group('foo', private=True)
+        v = registry.String('foo', 'help')
+        g.register('val', v)
+        self.assertTrue(g._private)
+        self.assertTrue(g.val._private)
+
+        g = registry.Group('foo')
+        v = registry.String('foo', 'help', private=True)
+        g.register('val', v)
+        self.assertFalse(g._private)
+        self.assertTrue(g.val._private)
+
 # vim:set shiftwidth=4 softtabstop=4 expandtab textwidth=79: