How secret are secret forums?

There are several risks here, in particular:

• An authorized user may reproduce your post elsewhere.
• The forum software may be flawed or misconfigured and allow anyone to log in.
• The forum software may later be reconfigured to be public.

You can't do anything about someone reposting your content, but fortunately that doesn't matter for your purpose. If someone publishes something in violation of your copyright, that won't affect your first rights.

As long as the publisher considers posting on a private forum to not count as prior publication, it doesn't matter if the post turns out to be publicly accessible in some way that bypasses the intended security. That would be no different from someone sneaking into your home and stealing your manuscript. It would be an illegal act on the part of the person who bypassed the intended security, and therefore it wouldn't could in any legal argument.

The case of a forum whose configuration changes after you've posted is more problematic, because it doesn't involve anybody doing anything illegal, and yet it causes your post to become public. To figure out such a case, you would need to know the precise circumstances (did you have a contract of some kind with the forum host? Were you informed that the forum might later become public?) as well as the publisher's precise rules for first rights (if he has rules set in stone or at least on paper). This gets into the realm of lawyers.

It wouldn't hurt to accompany your post with a disclaimer like “This post is only for review amongst members of the Springfield writing circle. Public distribution is prohibited.”. You would need to ensure that the place where you're posting it is indeed intended to be private to that writing circle, but the additional language might tip the balance in the specific case of a changed configuration.

Do note that this is not legal advice, it's some stranger on the Internet providing an unsourced opinion, which is worth exactly the paper it's printed on.

Well, the answer to your question is pretty clearly defined in the First Rights of Publication article you linked to:

What constitutes “being seen by the public” is the gray area of First Rights. But over the last couple of years, a consensus seems to have emerged.

Most publishers feel that if you “publish” or post your writing publicly on the Internet without any password protection, you have given up your First Rights.

Publishers do not consider something public if it has been posted in a password protected environment where readers must register and login before they can access the writing. In this case, most publishers feel that the work still retains its First Rights.

This seems pretty straightforward to me, and it makes it then less so of a question pertaining to technical aspects of how secure are private forums of this and that service provider, and more so author's intention not to reveal his/her works to the general public. This then makes it a legal issue at worst, where any potential such dispute would probably involve foremost determining one's intent, and less so (if at all) one's ability to judge security of third-party applications. Which, needless to say, might be quite unreasonable to expect anyway.

Make sure you make yourself fairly acquainted with service provider's Terms of Service (TOS), End User Agreement, and other relevant documentation that would describe authorship of published materials therein, though. The devil is in the details. Caveat emptor; many websites reserve the right to republish any materials posted therein by their users, or use it for website's promotion (Search Engine Optimisation or SEO is one of the tricky ones, but also RSS Atom feeds,...), and hide that fact somewhere within the self-harming dull legal yawn of a fine print.

Sometimes, best you could do is to put their claims to the test, by posting a new topic and a few replies to it, and then observing if this information contained within somehow leaks to search engines in the following weeks. Make sure you use fairly uncommon sentences and/or words that will simplify your search.

There's a simple-ish solution to your problem. First, acquire a dedicated server (or VPS) of your own or via a host. Put your software on it. Put the forum data in an encrypted volume loaded on bootup (helps later on). Use access control to ensure only the forum software can access that volume. Set up SSL or a VPN so that it's required to access the forum. Set up password-protected access to the site and give your friends the password. You can optionally, maybe via forum software, set up permissions of the various users.

Now, you have a system that only trusted people can connect to and that stores most confidential stuff in an encrypted volume that can be wiped simply by "loosing" the key. There's plenty of other considerations for making something approaching a secure forum. It's not easy. However, this basic setup will provide a baseline of protection.