I have added a new feature at poolp.org: hidden contributions.
A contribution usually is either private, public or restricted to authenticated users; which means that the contribution can be seen only by author, by everyone, or by authenticated users respectively.
It is now possible to flag a contribution as "hidden" so that it can only be fetched through a direct access. What this means is that whenever the website doesn't specifically search for a contribution with its exact unique id and label, the backend will not return hidden contributions as part of the results.
With this feature, one not only needs to have the proper credentials to match a private/public/restricted contribution, but also has to know where that contribution is located.