This has been fixed in another pull request. There is `putPrivate` and `putPublic` versions to be explicit about permissions.