private apps are accessible through the adress
consider a app private_guest belonging to 'guest' and private.
Now consider that 'devel' user is logged. The app is not accessible in app list through Apps or Browse menu, but if goes directly to https://localhost/apps/private_guest, access granted !
Jobs can be launched (at least until !164 is accepted).
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information